Can you share all the config or the relevant parts of your config file related to routing out: branch routes and failure routes? Or maybe you can make a minimal config that can be used to reproduce the issue?
I noticed info messages that suggest the from address is the right one for targets that private address ends up being used:
``` Nov 28 09:33:23 proxy4.ams1.mysipnetwork outbound1[16849]: INFO: Sending [INVITE] message from [udp:185.0.1.34:5060] to [udp:185.10.20.31:5060] ```