Coinomi is awful. It is closed source, and sends seed phrases in plain text to third party Google servers to be spell checked. Your coins could have been stolen this way.

Windscribe is awful. It is a free VPN, which means it is probably spying on you. They are also very amateurish, going as far as failing to actually encrypt any of their servers meaning that all data could be intercept and read, as well as running long outdated software which had been deprecated because of critical security risks. For example: https://arstechnica.com/gadgets/2021/07/vpn-servers-seized-by-ukrainian-authorities-werent-encrypted/

You have unfortunately used a terrible wallet and a terrible VPN on a long outdated phone (which will also be vulnerable to security flaws), and it is also not a cold wallet as you state. Doesn't matter if you only go online once a week, once a month, once a year - as soon as you go online once, it is no longer a cold wallet.

There are lots of potential ways your coins could have been stolen here, and it is unlikely we will ever know the exact method.