There is a known bug in WordPress that is about displaying feeds for private posts publicly. If you’re using the private post feature, you should consider taking a look to this plugin which is not officially available in the plugin repository but here:
Comment RSS Security
Plugin that enhances the default security behaviour of WordPress. Disables showing comments related to private posts in RSS.