I captured on all interfaces (not only the one connected to ISP) and both firewalls. Only my firewalls advertised VHIDs. Could not spot any foreign MACs...
Moreover beside VHID=3, also 5 caused the same issue.