Pathauto 8.x-1.6 is the only version working with both Drupal 8.7 and 8.8. So first update Pathauto to this version, then update core and then update Pathauto to the current version. Run drush updb in each step. See the change record http://drupal.org/node/3089457.
As others have said, & is a reserved character with special meaning in urls.
There are a couple options to remove or replace ampersand rather than have it be rewritten to %26 with the pathauto module. Note that these options only apply to aliases that are auto-generated, i.e. when the content has "Generate an automatic URL alias" checked.
The ampersand (&) is a reserved character in URLs because it is usually input as part of the query string. Some more info.
Most special characters can be used in URLs with the settings you described in your question, but & is an exception. Either just live with %26 as the encoding or rewrite the title to not use the & symbol, which is reserved.