Second significant recorded leak from a meeting with Congressional Republicans in a week.
In such private meetings, the possible leaker is limited to:
The attending Republican members of Congress,
Any of the congressional or administration aides who attend,
Any venue staff who might be serving refreshments or managing the event,
Any security personnel on hand.
By process of elimination, since this has happened twice, presumably in different venues, the person most likely doing the recording and turning it over to WaPo is either a member of Congress or one of their aides.
A more remote possibility is that the venues were bugged in some way.
Trump and Pence should just assume that every meeting room in D.C. is bugged.
McCain or Graham.