In CB Activity Tab I have asset "user, user.connections" , and I mostly see just the activity of myself and my connections, but I am also seeing posts from my connection to an invite-only group that I don't belong to. Major privacy violation. How to fix?
GJ is entirely responsible for that access check. Ensure GJ is up to date. You should not see invite only activity unless you've access to that group. If you are a CB Moderator then you have access to that group and will see its activity.
I also can't tell what the difference is between "user.connections" and "user.connectionsonly"
"user.connections" shows you and your connections activity. "user.connectionsonly" shows only your connections activity.