Simple home system: UT in Routing mode with a dynamic IP address and all internal connections through a single switch.

Data usage has significantly increased recently and when I created Network|Top Client Data report (based on the Top Client Addresses report), I can see clients from outside the internal network. On some days, these 'external' clients download greatly exceed the sum of all internal clients. For example, on one day the total download for these 'external' clients was 10 Gbytes which was 91% of the total. In all instances these clients have addresses owned by my ISP but are not my IP address. In most instances these 'external' clients get the data from a CDN like Cloudflare or Fastly. The 'external' clients do not show in the list of Hosts.

Does anyone know how 'external' clients have been able to get behind the firewall?