Can one tell if the traffic shown below is from the ISP side or not?

[pasha-19]

Is traffic from the ISP side or my internal network side?  I believe from the ISP but when reporting it to them they did not "see" the traffic on their side.

You cannot view this attachment.

[BrandyWine]

It's exactly what it says. RCF1918 seen as src IP unbound on WAN iface.
It's a local multicast, probably from the iface of the modem. ISP wont see it because they wont see that multicast upstream from your ISP modem.

What is the DFG of your firewall?