Hi Alex
I wouldn't worry too much about these. They're kind of an anachronism.
I just stumbled over your article: https://www.cnblogs.com/shunzh/p/14360712.html
This helps a bit. After looking again at the issue I observe, I think I have narrowed it down on the alias not being set on the replies.
So a 200 OK from a CPE behind nat, has a contact pointing to the IP behind nat. Thus an ACK to that 200 OK is being routed to the IP behind NAT.
I will keep digging into this and probably just have to get rid of trying to understand how the NAT flags are being used in those examples I found earlier.
Mit freundlichen Grüssen
-Benoît Panizzon-