Unknown utun0 Connection in Local Network

I’ve installed ProtonVPN and use it occasionally. Upon logging in, nothing has changed in Terminal apart from the address, which is now fe80::5b74:cd7b:849:8538. Connections to ProtonVPN are associated with ipsec0, though—does that matter?

Here’s my EtreCheck report: https://pastebin.com/NyTcanF6

According to System Preferences → Extensions, no third-party extensions have been installed. As the EtreCheck report shows, however, there are kernel extensions of Malwarebytes, Little Snitch and LuLu. Could any of those cause utun0?

I should note that the utun0 interface is shown by ifconfig whether an internet connection is established or not, even immediately after booting before plugging in the ethernet cable. Again, as far as I know, I have no VPN client installed, and System Preferences → Network only displays Ethernet, Bluetooth PAN, FireWire, Wi-Fi and Thunderbolt Bridge, with only Ethernet being on; all Sharing options are turned off, and the discontinued Back to My Mac doesn’t even appear in my iCloud services any more.

I’ve never consciously used Back to My Mac or checked any of the Sharing options; I even removed myself from “Only these users:” and blocked all connections for Screen Sharing in Little Snitch. FileVault is on, and the built-in firewall in stealth mode blocks all incoming connections.

Still, I’ve been observing in recent weeks that (1) settings have been altered (including the microphone input volume, which had always been off, suddenly turned on), that (2) files such as bookmarks in Safari were suddenly deleted, and that (3) I was suddenly logged in to ProtonVPN even though I wasn’t even connected to the internet yet. This definitely wasn’t me and has been going on for weeks despite several complete reinstallations from scratch on different hard drives.

Is there any way for me to identify if someone is somehow able to monitor (be it via stream or perpetual screenshots) or access my system without my consent or knowledge?

If you spot anything suspicious, please let me know.

I’ve uninstalled ProtonVPN and rebooted the machine several times, and although I now don’t have any VPN client installed any more, the entry persists:

utun0: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST> mtu 2000

inet6 fe80::30f3:834d:8903:9df4%utun0 prefixlen 64 scopeid 0xd

nd6 options=201<PERFORMNUD,DAD>

Again, the IPv6 address changes every time. Any other idea what it could be? A remote VPN connection?

So you don’t spot anything suspicious there? I was wondering if the number of “*:*<->*:*” might not be too high.