CGNAT should be in a 100.64.x.x/10 range. I'm wondering if bridge mode isn't actually bridge mode.
Although thats the recommended range to use according to the RFC for CGNAT, they
could also be using another private range like 10.x.x.x/8 (favoured by lots of mobile providers) or for that matter 172.16.x.x/12
Although 192.168.x.x/16 gives far fewer hosts, it is private, they could theoretically use it. Would be pretty odd though...
If the OP puts the TP-link ISP-side router back into router mode, wonder what WAN IP address his router gets then?