I would actually use the "last" command.
$ last > ~/Desktop/last_users.txt
will output the results to a document on the desktop you can open up and have a look at. Really, you should see your own user, reboot (a pseudo-user that gets activated when rebooting the computer), and just about nothing else. I. personally have a "_mbsetupuser" that has to do with updating my OS, so you may have that as well.
If you see any usernames you don't recognize, that's a red flag. If you see your own user on a tty other than "console" that might be an issue. I'm not really great with netstat nor lsof, but here's an lsof primer. The reason to learn lsof (whether in conjunction with netstat or not) is that linux treats most things as files. lsof (short for "list open files") is a utility that helps you find out which files are open. If someone's watching your system, they're opening "files" to do it, and that utility will show you that, unless there's a rootkit in place and/or the lsof utility itself has been hacked/modified to not show their presence, which is unlikely.
See a primer I quite like here: https://danielmiessler.com/study/lsof/