Can a networking guru tell me if I have a double NAT and why my 3rd hop times out?

[Tyche]

What the hell did I do? I feel like I recall messing with shit when my brain was not in a state that needed to be messing around with shit and I'm a below average network try-hard.

The Tracert issue

WAN settings

2.5gb fiber

FTTH Calix gigapoint gp1100x ONT (I'm told it does no routing, and they supplied a router that is not being used)

TP Link, all Omada SDN

ER707M2 router
WAN1- From ONT
LAN2 - SG2210XMP Switch
LAN3 - SG2428P Switch

No VPN. No ACLs. Running tracert from a Windows desktop wired to the SG2210

Spent way too much time googling fixes. I've noticed in troubleshooting that I can try to open a port, but when I check it using the various online tools, it reports the port closed. I don't remember what I did, so no clue what to even ask or what info to give.

[2 tracerts

[Krandor]

Does your ONT have any configurable settings (like passthrough mode or whatnot)?

ATT had some outage in my area a few weeks and whatever caused them to factory reset mine which fucked up a bunch of my shit until I realized what was happening

[Byrthnoth]

That second hop looks weird to me.
Private
Public (almost but not quite your gateway IP)
Timeout
Private
Private
Private
Private
Public

Could you explain how it is supposed to work?

[Tyche]

So, I found out the mysterious public IP just before the timeout is an address range pool that's just for CGNAT. This has to be new, as I was able to forward a port last week.

ISP and I are about to have a bad time.