@BearHug...are you familiar with the developers of Express VPN? "Suspected Network Sharing Device" could mean alot of things, but if you don't know about your VPN, maybe you could look into the company and find out more. You might feel better at least if you can validate your impressions of the company.
Only reason I say this is because I think I have seen how trusted programs can get away with so much, especially, for example, browser extensions, since they are considered part of the browser. Think I had a BitCoin miner for a short time, but I also think that it was only in memory. I had added NoCoin extension and once I removed that strange behavior ended. Sounds like EVPN is different, being a standalone application, but for a VPN I like to know the company I am dealing with is very well known around the world etc...
Good idea to check for malware too o/c