Someone is trying to sign in to my account, although they are
using .'s where I do not. I am getting emails sent to my secondary
account about changing my password.
Is there anything I need to do in addition to changing my password?
No. This is, in all likelihood, not a hacker but simply someone who
forgot their true address and believes that their address is one of
yours instead. (Remember that gmail ignores dots in email addresses,
so all variations with dots are yours.) Just ignore the password reset
requests and you should be fine.