Is traffic from the ISP side or my internal network side? I believe from the ISP but when reporting it to them they did not "see" the traffic on their side.
Traffic.bmp
It's exactly what it says. RCF1918 seen as src IP unbound on WAN iface.
It's a local multicast, probably from the iface of the modem. ISP wont see it because they wont see that multicast upstream from your ISP modem.
What is the DFG of your firewall?