I'm under the impression that the router forms a VPN tunnel to an endpoint at the ISP (which is why public users have a different IP and their traffic is easily

I'm under the impression that the router forms a VPN tunnel to an endpoint at the ISP (which is why public users have a different IP and their traffic is easily proven not to be that of the subscribers)