Exede will INFER what sites you visited and what was connected by the type of traffic they see. The problem with that is that every website is built out of a large number of blocks or modules if you will.
They can take on many characteristics based on the site itself, Operating System settings, browser used and browser settings and of course any browser extensions that are installed.
As to your Router being "password protected" I'm afraid that a Router has a few more aspects to it that you may or may not be aware of.
In addition to having a strong Router username and password protecting the Router's GUI there is also the matter of wireless security encryption being enabled properly as well as disabling all Guest Accounts, disabling WPS and knowing what internal router services if any are enabled and active.
In addition Netgear, Linksys and Cisco routers have had recent security issues announced that makes them vulnerable if not patched with the latest firmware update.
There have been many changes in the way Microsoft does business lately that many users are not aware of ..... Telemetry and updates now delivered as "roll-ups" as well as some update/fail loops that can really burn through a lot of data.
Many sites have increased the number of "Ad modules" that make up their website. Many more now "auto-start" video content and probably the most invasive and least understood is the HTML5 video "pre-fetch" of embedded video content that will preload all video of that type without your knowledge so that it is instantly available .... as a courtesy ... just in case you wish to see it. That activity has to be blocked with specific browser extensions.
The only way to tell what is consuming your data ... on that single computer is to install the free version of Glasswire. That will tell you the details of what is needed such as FlashBlock, AdBlock Plus and Flash Control.
Rather than a lot of reposts there are three topics that I have replied to at length that I think you would benefit from. (yes they are long but your answer lays within them)
Here is an example:
Today between the hours of 7 &9 am Internet Explorer used 92 MB in total . 90.9 MB download and 1.1 MB upload.
If we look a little deeper we find that one of the places "visited" was "prod.giphy.map.fastly.net
Now I didn't KNOWINGLY go there ... either a background process did or it was the result of a data feed from one of the webpages I did visit in that two hour period.
In any event, known or unknown it used 1.2 MB of data.
I can pull up the IP address of where it went and see who is associated with the address but the overwhelming fact is ... is used data that I otherwise wouldn't have known where it went.
And my ISP had nothing to do with it.
There are also 46 more "places" that used data except I had not visited 46 websites in total thus far today.