The message reported is probably "your screen is being observed".
Various of the possibilities are harmless. This message can be triggered by remote access for screen sharing when that is configured and enabled (System Preferences > Sharing > Screen Sharing, and Remote Login, and Remote Management), if AirPlay is in use, by a screen recording session previously triggered and left to record, and by add-on apps that tie into the display (System Preferences > Security & Privacy > Accessibility will list the apps that can access the display).
What to do? Update to current macOS, ensure your backups are complete and current and rotating off-site if your data is sufficiently valuable, remove any add-on security apps or add-on VPN client apps or related sorts of apps, and change your macOS login password or passwords, and change your Apple ID password. Use new and unique and robust values for all passwords, as attackers routinely search for re-used passwords are actively sought and that can be with disastrous consequences.
If you're connected on a private network that you control, also make sure that somebody hasn't poked paths in through the network firewall / router / gateway / NAT box; if somebody has unnecessarily enabled port forwarding for any ports, and particularly for TCP port 5900. (List of Apple well-known ports.)
As for tracking the origin of a remote connection, that tends to be approximately futile.
These sorts of questions are generally better addressed in the Apple Support Communities, too. FWIW.
