Possible rogue admin monitoring my online activities

Question

I teleworked for a medium-sized software company. We had a network architect who offered me a firewall to install so I could securely access on-premises resources and play around with some configuration settings because I'm interested in security. The CEO was also given a firewall for his home. I have reason to believe the architect monitored what I did on my personal devices. A few details:

1. The only endpoint plugged into the firewall was my work laptop.
2. The architect has admitted to cyberstalking co-workers in their off hours, particularly their live streams at church to see if they're complying with COVID mandates. This isn't illegal, as the streams are public, but it is creepy IMHO.
3. The architect made reference to something very specific that I have done only on my personal devices.
4. I specifically asked the architect if he could see my Wi-Fi traffic, to which he denied, and responded that he could only see broadcast communications.
5. When I realized 3, I immediately disconnected the firewall. Soon after, maybe a day or two, he asked me why I had taken it offline.
6. I brought my personal device to the office to do school work. (This is my mistake, admittedly.) He showed me my Wi-Fi password for my home network as a "joke."

His behavior has made me extremely paranoid, and he has bent the rules at work and engaged in manipulative behavior. As a result, I've done the following:

• Disconnected the firewall.
• Reset my router (and its password).
• Reset my passwords: password manager, email, banking, just about everything.
• Nuked my personal laptop. Fresh install of the OS.
• Closely monitored my finances and accounts for suspicious logins and users. No anomalous behavior.
• Left the company (for this and other reasons).

I still do not feel safe. I want to replace all of my hardware, and change my phone number and email address. Questions for the group:

1. Could he be monitoring my activity after the mitigation I've done?
2. Is it extreme to replace all of my hardware and nuke all of my accounts?
3. Is there anything I can do from a legal (USA) perspective? I wish I had taken a screenshot of the firewall settings and shown them to a network engineer.

I don't want to go through the process of replacing everything, including my phone and number, email account, etc. unless absolutely necessary. Thanks in advance for sharing your thoughts.

Answer 1

1. Incredibly unlikely. For the average part-time actor, they might have been doing ARP spoofing or something akin. That would allow them to see DNS requests (what someone visits) and any unencrypted traffic (very little these days with TLS) but nothing more. Removing their device is enough of a mitigation. Top of the line attacker might get their victim to download malware/trackers, a cursory wipe is probably good enough for most of these threats.
2. Probably. But security is about threat models. So, if you think this person is capable of hiding viruses in your bios or some other ridiculous attack vector, feel free.
3. IANAL but definitely not without proof and probably not without material damage

Occam's razor: It's a person in power who loves abusing power and is a low level bad actor (not a criminal mastermind). Any attack (if one was perpetrated at all) was probably amateurish parlor tricks at best.