A few but somewhat obvious things to do...
Use a trial version of anti-virus to see if anything is detected there for starts. Your listing two different OSes which makes malware a bit of a long shot as mobile malware is generally very targeted.
Second thing to check is what Wi-Fi are these phones connecting? If you live in the city where I have seen over 200 available connections would mean you have your work cut out for you to identify a specific connection if its just a hijacking. This really isn't as hard as you might think.
Third, consider both phones to be breached and untrusted. Change the passwords and if need be have both phones wiped and reloaded with a fresh OS image.
It is possible to do a full phone forensic examination but that will put you without a phone for a couple of days and would be prohibitively expensive unless you can DIY.
Let us know what you find or decide so we can satisfy the technical curiosity, if you would please.