router shows external address with dhcp

We are having issues with slow pages (sometimes not coming in at all),
Looking at the logs, I am showing a lot of DOS attacks from source of 2.1.120.48 to target: misc. other websites. Usually one website is shown for 5-6 times then it goes on to another website address. Some are ping of death, some are teardrop.

When I look at the list of attached devices, I see 192.168.0.10 for one device, 192.168.0.12 for another, etc and then when we are getting the dos attacks then one of the devices will have the internal ip of 2.1.120.48. When the dos attacks are not occuring then that device will go back the the regular dhcp address and show 192.168.0.15. The address change does not happen to one device only. But it might take over the address for one phone at lunchtime and then in the evening it might be someone else's phone or an ipad, etc.

I have reset the modem/router to factory default, the admin password has been changed, remote management is disabled, Comcast provisioned the modem, etc.

I have tried to block that ip address, but the router says that it's not an internal ip address so it won't allow the block.

Any suggestions?
Thanks