Yeah, I agree with ‘nuke first ask questions later’ when your compromised host is impacting other devices. If and only if i knew the attempts weren’t going anywhere or doing anything would I consider unicing the vm/container to see what happened.
Without having access to a known good connection (or known good setup) you can’t 100%, but if you can take packet captures at the handoff to the isp equipment and the far side doesn’t receive them, that’s a pretty clear indicator to me. At the very least it would be enough for me to reach out to them and ask what’s up.
If it’s there that consistently, it might live there (is that a school over on the left?). But even schools that don’t regularly collect students with dedicated school busses might want to have some for taking groups places, either transporting them between buildings in the district or for field trips or similar.