Private nodes in Private group are visible to non-members by their URL
I had a similar issue too.  In the end, my mistake was having "group visibility" set as a field for the Post content type when it should have been "group content visibility."