1.As another said, change your iCloud password. Be aware all of your devices that sync with your iCloud will need the new password entered.
2. Log into to your iCloud. Do that from a browser then click on devices. You can do it in your iPhone by going to settings>your name and look at the device list but for this I’d use a browser. Do you see a device in the list that is not yours? If so delete it/them. In combination with this and the password change, this would stop that device accessing your iCloud account. (Side note, you will receive an alert when you log into iCloud via browser. Be aware of these alerts in the future).
3. Review your iCloud personal/security information. Is it up to date? Is the personal information look unfamiliar? Fix it. Remove any emails or other contacts that you don’t recognize, any email account that someone else has access to.
4. If unauthorized accessing of data isn’t through your iCloud then realistically the only way on iOS for unauthorized access to any data on the iphone is through an app (that somehow got by Apple App filtering div). Delete apps you don’t recognize/aren’t sure of. Restart your iPhone.
With complete due respect intended, “mirroring” an iPhone from a second and illegal iPhone located remotely is a very extremely unlikely technical feat that has been pulled off. Nothing is impossible but very extremely improbable. A friendly suggestion for alternate explanation: someone has accessed enough of your information online to allow them to give you the illusion they are mirroring your iPhone. If someone is giving you the impression they have “mirrored” your iphone in an attempt to get you to do or give something, don’t! It almost a certainly this is a scam/ruse. BOL