You don't need to reflash GrapheneOS. A factory reset does the exact same thing.
Even if your laptop/router has been compromised (I'm not going to fight you on whether it has happened or not; I don't know your circumstances), you don't just "hack" a Pixel device running GrapheneOS.
Unless you think the person doing this has millions of dollars or is some insane blackhat prodigy, you should keep in mind that Android is an extremely secure platform, and GrapheneOS only amplifies that. If they've been able to unlock your phone and potentially install software on it, then they might have installed some stalkerware app, which when given accessibility permissions can have a lot of control over your device, but that's gone with a factory reset.
If you've used Auditor before this point, you could also do a check and see whether any accessibility services have been enabled (Auditor presents results on attestation.app or the screen of a secondary device, which is useful, because an app on your own phone could present fake results if it had been taken over).
Your phone is very likely fine. You should also consider what someone said above: if someone can log into the router's admin panel, they can see traffic coming in and out, that's much easier and more likely than sophisticated persistent malware. The simplest explanation is realistically going to be more likely, as much as we can get carried away.