ARRIS device connected to my network? Hackers? Whos doing this?

There are several threads here about that. It's probably not a hacker but something else.

@user_9f3f82 

Please remove the MAC address of your modem for your privacy.  It is considered to be personal information. Personally identifying information is a violation of their forum guidelines. Your post will be marked as being "Private" and hidden until it's removed.

Unfortunately, we cannot see how information was compromised or who did it. I know that itself can be frustrating. I too, have to change my passwords every so often. Did you need further assistance in helping with your password issues? 

It's a shadow function of the Arris router...  I saw this before and sniffed the traffic.  I think it's a part of the diagnostic function that it spun a separate MAC to connect to the main SSID, or the Hotspot feature that try to create some type of mesh.  This is one of the reason I hate Comcast router - a lot of mysterious features/behaviors they don't clearly explain. 

FWIW. We've also seen posts here over the years that relate it to being the built-in hardware firewall component of the gateway device.