I’m taking a stab in the dark here, but are you dropping guest Wifi onto the local LAN and then via a NAT on the ISR putting it into a GRE tunnel that then drops out into a DMZ or similar at a head-end?
If this is the case then you’ll most likely have to look at rearchitecting the wireless guest network, rather than solving it in the way you currently do. Are you using Wireless Controllers? Are they centralised? Can you use Local Mode on the controllers for guest? Can you add a guest anchor for the guest traffic? Do you even need the guest traffic to be backhauled across the WAN?