Help please

Allow some remarks (even if i don't qualify lack of practical experience).

• The Orbi Pro does support the new Insight Content Filtering - just like the Insight WAC and WAX do as plain AP - so I assume the Orbi Pro can handle it in both router and AP mode.
• I can't see any option where we can select which Insight device(s) are activated for filtering. If multiple device in the data path have Content Filtering enabled, for example an Orbi Pro and a WAC5xx/WAX6xx on it's LAN, each DNS query will be checked multiple times. The performance geeks might complain about the added delay, and everybody will see a multiplied use rate on the Content Filter counter of 200k per day.
• The BR500 does not support the new Insight Content Filtering, I guess you use the BR500 as the router, making a wired data path not passing the Orbi Pro not captured by the filter.
• Completely lost on how making the Xfinity to a plain bridge alone should change the Content Filter behaviour.
• Additional to the bridge mode: Have you reconfigured the Orbi Pro to router mode along with this config change? But now I don't know what/how the BR500 should work, because in my understanding, also Xfinity does only allow one router attached (except for business contracts).
• For any testing, be aware the major OS have a local DNS cache, so quickly enable/disable some rules won't have an immediate effect - except you are going to drop the DNS cache on the test device.

YeZ lot of oddities to clear up here!