As someone who has spent quite a long time building CGNAT solutions I have some good news for you, there is an easy solution to your below point that works exceptionally well. The solution is dual stack IPv6, its trivial to route your IPv6 to bypass the CGNAT device you are using and pretty much all of the major CDN providers are fully IPv6 enabled. In the real world this halves the amount of traffic your CGNAT solution has to process. Gaming companies (Not Sony!!!!) are also starting to support V6 so that can be a win too. I’m not one of those V6 is the solution to everything engineers as I live in the real world, but in this case it absolutely is a good workable answer. - The need for detouring the traffic that doesn't need CGNAT(Internal CDNs, Internal Servers, etc), to stay on the license limits of those boxes, sometimes brings some issues.