I wonder if SIP ALG is re-writing the packet to use your public IP as opposed to using NAT and discarding the original. Does your traffic decrease with SIP ALG disabled?