Well I saw this after contacting them. They verified that it was someone using my Xfinity login to access an Xfinity hotspot. I changed my password and turned on 2FA (yes, I should have had it on before). They seemed to believe that it wasn't me, but I don't really know. Now I get to go change all my passwords just in case.
I don't think I have WPS on, but I'll double check.