On the other hand, as an ISP, you can pull some of those addresses for your CGNAT's external address pool. Your customers' gear will never see those. Server side will, though. But then, troubleshooting cloud/server front-end to reliably let those through sounds like a more doable chore?