I've received a message saying that my Apple ID was used on a device that is not mine

See this article for further suggestions (though you've done the important ones):

If you think your Apple ID has been compromised - Apple Support

The notices from Apple that your AppleID has been used to sign in on a new device will always use PDT. Apple’s headquarters are in the Pacific time zone.

If you were able to get in, change your AppleID password and set up 2FA then your AppleID is secure.

It came up with another recent post by someone with a similar situation. When I went to check my email trash for my iPhone XS activation email (to check the message format for the poster to see if it was legit), I noticed it and checked some other emails of mine to see if it was consistent and it was.

In hindsight it makes sense to me to use one common time zone in those reports since a hack login could be from anywhere and the device location may only be approximate or outright incorrect. But the real owner would know where they where so could quickly figure out where they were when the alert system got pinged.

The nerd in me says they should be using UTC, but hey, when you’re a CA based company, PDT works too.

If you've added 2 factor authentication your next step, if you haven't done it already, is to register alternate ways of receiving authentication codes. You don't want to be dependent on always having your primary device with you, or stuck if it is lost or stolen. Other devices can be any Apple product with an Internet connection, or any telephone number, including landlines.

I'd never noticed that. Very useful information.

Michael Black wrote:

The nerd in me says they should be using UTC, but hey, when you’re a CA based company, PDT works too.

I'm inclined to agree with you. But, Apple is Apple.