Why is someone else's iPhone connected to my Apple car play?

They had to have been in your car at some point to be able to pair to your car before. The app you referring to is the one on the car head unit right? Because there isn’t an actual CarPlay app on the phone. You could simply remove the phone that is paired to your car via the settings on your car.

Not unless their iPhone is actually connected to your car. If they aren't in the car with you, they cannot use CarPlay in any way in your car.

You're welcome. Now remove that phone from your cars infotainment system.