That queen was, from what i vaguely remember, in contact with the king of the gauls and i think we can asume they also have spys in capital if not in the palace. Or it could be traitors/plotters in the east, there really is no shortage of people which would have known the MC has left the army, for example Felix (could also explain why the new appointed and apparently capable legatus, was beaten so fast and soundly, to the surprise of the MC).
As for Aristhenes
True, thought we do not know when he knew that it was the MC which will be the next head of the royal guard.
We also know there were incidents before the MC even arrived, and the reason he even was send for, so there are clearly other enemies within the palace which could know.
Also i think Aristhenes would have rather judged the MC himself first, seeing if he maybe would be a good ally to have before trying to get rid of him.
For all we know the gods could be involved, like the one which can't stand Anna and is worshiped in the east.
See, the issue I have with that is the timing. It's not like they've got phones or radio, so to deliver a message about goings-on you have to literally
deliver a message.
Given the travel methods and distances involved you can assume it was a trip of at least a week or so from the capital to King Brennus to inform him of something a spy discovered (unless they have an usual amount of autonomy). Then after taking a day or 2, he has to send a message to Queen Cunt
WAY on the other side of the empire. That's a distance of at least a month and a half and the message has to get through at least 2 unfriendly borders.
Similarly a spy in the capital going directly East with a message would take about a month to reach his destination.
Now, obviously a local spy that was already
IN the East would have a much shorter distance to travel, so you might think that's the obvious choice, but the problem is when the MC left, Queen Whatsherface wasn't showing any signs of ANY of this. He assumed shit was safely being handled with no problems arising. Given the length of time between when he arrived back in the capital and then the message from the East saying she had attacked and fucked everyone up she launched her attack practically the minute he left, but you can't muster and mobilize and army that fast, especially not back then. Even today a rapid reaction force takes like 16-96 hours. Back then you'd be talking at least a week or 2 to get everything ready. You'd think the MC and his military guys would have been keeping an eye out for this sort of thing, which means it was done
REALLY stealthily, which takes even more time.
Since you can assume the MC would have left within a few days of receiving the summons, and that the attack happened almost immediately after his departure, it's too fast for it to have been from a local spy, and a spy from King Brennus would have taken too long. It had to be someone with knowledge of "The king is planning on recalling the general. He's going to send the message next Tuesday after his ablutions (

)". That means someone from the capital in the inner circle and Aristhenes is the most obvious choice.
At least that's how I see things.
I suppose another alternative is the MC's army guys in the East were all in on this and delivering false reports about the Queen's battle-readiness, but that's a bit of a stretch. It'd take quite a few of them for that to work.