Before you read the result
What X-VPN documents about these signals
The points below are drawn from X-VPN's help centre articles and its feature page. Knowing the intended behaviour first is what lets you tell a normal reading from one worth chasing.
The kill switch is a toggle you turn on
X-VPN's help centre describes Kill Switch as preventing any data transfer by shutting down your device's internet connection if the VPN is unexpectedly disconnected. It tells you to enable it yourself: on mobile under Me, VPN Settings, Kill Switch, and on a computer under Settings, VPN Settings, Kill Switch, after which the button turns blue. If a check shows an address you did not expect, that button is the first thing to confirm.
The protocol can change under you
According to X-VPN's help centre, the app moves to another protocol when the selected one cannot establish a connection in the current network situation, and a change in the network your device is connected to can cause a background reconnect that also switches protocol. A reading taken before you moved from one network to another and one taken after are therefore two different connections, and comparing them is the point of running the checks again.
Some servers use one protocol only
X-VPN states that its Everest Line servers are bound to a specific protocol, TLS-3, and offers an Auto setting that picks the protocol for you. If you connect to an Everest Line location the protocol choice is already made, which is worth knowing when a reading differs from one you took on another server in the same session.
DNS is meant to stay away from your ISP
X-VPN's feature page describes a private DNS server that hides your activities from your ISP and prevents DNS leaks. A DNS check taken while connected should therefore name a resolver other than your provider's. Your ISP's resolver appearing in that line is the result the feature is meant to rule out, and the reading to repeat after the next reconnect.
Split tunnelling decides which apps are inside
X-VPN offers split tunnelling that lets you choose which app is routed through the VPN and which accesses the internet directly. A browser left outside the tunnel reports your own address by design, so when the IP check shows your own connection, confirm which side of that setting this browser is on before reading it as a leak.