Hi,
When you have two-factor authentication enabled for your Apple ID, each time you sign into a new device or online you will receive a notification on your trusted device or trusted phone number associated to the Apple ID.
The notification that appears on the trusted device gives you the option to deny or allow the sign-in attempt, and should say “Apple ID sign-in requested”.
When you tap “Allow” you receive the six digit verification code required to complete the sign-in. It does try to ping the location, or the nearest location, based on where the sign-in attempt is requested, and majority of the time is incorrect. If it is you signing in to your Apple ID at that moment, this is expected behavior.
https://support.apple.com/en-us/HT204974
If you still feel your device is not secure, I would recommend checking to see if you have any profiles or configurations installed within Settings > General > Profiles.
* Please note this option only appears within Settings if you do have a Profile installed. If you do not see the option within your Settings, nothing has been installed.
https://support.apple.com/guide/iphone/install-or-remove-configuration-profiles-iph6c493b19/15.0/ios/15.0?
https://support.apple.com/en-us/HT209435
If, for whatever reason, you still feel general unease, I would recommend erasing all content and settings in order to set the iPhone up as a new again. Do not restore from a backup.
Settings > General > Transfer or Reset iPhone > Erase all Content and Settings.
I would also like to point out that Apple takes customer privacy and security very seriously. It is extremely unlikely that the device has been compromised. However, if you jailbreak your device, or engage in other unauthorized modifications, this can result with the device becoming exposed to vulnerabilities.
https://support.apple.com/en-us/HT201954
https://support.apple.com/guide/iphone/use-built-in-security-and-privacy-protections-iph6e7d349d1/15.0/ios/15.0?
Hope this helps!