My routers have been hijacked by remote and VPN I think?

James, what you are asking requires a computer forensic specialist to get an image of all the networked devices in the home.  Also what is required is a network tap to capture all incoming and outgoing traffic for analysis.

By the content of your message I can only assume that you are in the US.  Have your parents signed up with the 5 major credit reporting agencies (Experian, FICO, Equifax, TransUnion, Innovis, PRBC) and are getting monthly reports or have locked their credit reporting status.. This costs about $20 / month and must be renewed every 3 months. You also have to contact all of the credit card companies and lock down the credit cards to then use a call to authorize all credit card transactions. (two factor authentication)

Identity Theft has been around for a long time (pre Internet) and prevention is really the only item as recovery from ID theft is a long and arduous process. The entry point may not even be computer related but via social engineering and dumpster diving to get the required information.

Your parents might have been duped by an email message and given out this information to a counterfeit site or over the phone to someone impersonating a legitimate company. The avenues of ingress are quite considerable.

Router and other logs can be helpful but they can also be incomplete or misleading depending upon the level of the hacker as once they have access they can delete entries or add entries at will.

Suggestions: have a 2nd router behind the ISP's connection and turn off remote access from the WAN to this router, disable the wifi connect button on the router. For WIFI always use WPA2 and never WEP.  If possible use a hidden SSID.  If the bank or someone else calls you and you did not request the call.. then tell them you are busy and then call them back using the listed phone number as Caller ID can be spoofed.. If you get an email about suspicious activity on your account don't open the link from the email and first examine the mail to check that all of the addresses are 'exactly' as to what they say they should be .. i.e. support@paypal.com and not support@paypa1.com.  What you should do is go to the site yourself and once there check the certificate i.e.
Unfortunately this is ALL before the information was stolen once the information was stolen or otherwise acquired it is a long and arduous process to recover from it.