Unwanted device in the router list

Recently I found an unwanted mobile device which I didn’t allow or give any password to is connected to my TP-link router.

The default Wi-Fi password was already changed and didn’t activate WPS. The security is set to WPA3-Personal+WPA2-PSK[AES]. Guest and IoT network aren’t activated either.

Idk how a cell phone got the ability to use my router without being provided with a password!

arp -a command result isn’t exactly comprehensible to me, and also found other user(s) reported here that this command doesn’t necessarily list ALL the connected devices.

How do I stop this and through CMD find if there are other unauthorized devices also using my network without my permission (which I will never give).

Thank you.