What is Ruby doing with gsub here?

gsub does a global substitute on a string. If I had to guess, the URL might be in the form of

http://somewebsite.com?member_id=123

If so, the code has the following effect:

url.gsub "member_id", "member_id__hashed"
# => "http://somewebsite.com?member_id__hashed=123"

Assuming member_id = "123", and member_id_hashed is some hashed version of the id, then the second line would replace "123" with the hashed version.

url.gsub member_id, member_id_hashed
# => "http://somewebsite.com?member_id__hashed=abc"

So you're going from http://somewebsite.com?member_id=123 to http://somewebsite.com?member_id__hashed=abc

Documentation: https://ruby-doc.org/core-2.6/String.html#method-i-gsub

I'm assuming that the url at the end is Ruby's equivalent to return url;

If that code is part of a method or block, indeed, the line url is the value returned by the method. This is because by default a method in Ruby returns the value of the last expression that was evaluated in the method. The keyword return can be used (as in many other languages) to produce an early return of a method, with or without a return value.

that's the wrong syntax, right? shouldn't it be

url = url.gsub(var1, var2)?

The arguments used to invoke a method in Ruby may stay in parentheses but they may, as well, be listed after the method name, without parentheses.

Both:

url = url.gsub var1, var2

and

url = url.gsub(var1, var2)

are correct and they produce the same result.

The convention in Ruby is to not put parentheses around method arguments but this is not always possible. One such case is when one of the arguments is a call of another method with arguments.
The parentheses are then used to make everything clear both for the interpreter and the readers of the code.

If it is correct, why are they calling it twice, once with quotes and once without?

There are two calls of the same method, with different arguments:

url = url.gsub "member_id", "member_id__hashed"

The arguments of url.gsub are the literal strings "member_id" and "member_id__hashed".

url = url.gsub member_id, member_id_hashed

This time the arguments are the variables member_id and member_id_hashed.

This works the same in JavaScript and many other languages that use double quotes to enclose the string literals.

String#gsub is a method of class String that does search & replace in a string and returns a new string. It's name is short of "global substitute" (it replaces all occurrences). To replace only the first occurrence use String#sub.