I've problems

Looks like your firewall might be working, but I'd have to know exactly what you are using, plus the logging syntax to tell you for sure.  It 'may' be telling you there was traffic from both internal and external sources that got blocked, but it's all about the log format.

Below are all hostile actors tripping over my SNORT firewall trap.  They are KNOWN compromised servers in this case, but it works with unknowns too.  Anything that hits these ports.  They are running portscans, and are using automated scripts.  It's extremely common internet traffic.  Some 3rd party gateways have a "portscan block" option too.   Use it.  The idea is that you 'kill state' and block all traffic from the offending source for a time to disrupt the scan.  If their script doesn't have much for error control, you can hang the remote end too.

Turning off ICMP (responding to ping) on your gateway if you have the option is a good idea.  They usually ping your external IP address before the portscan to see if anything is there before running the portscan.

Compromised servers in the nethernlands, cyprus and a cloud spammer named Eonix in the USA.

This issue is posted so many times in the xfinity forums WITHOUT ANY RESOLUTION OR EVEN A RESPONSE FROM COMCAST. Unreal.