I'm seeing ipip traffic getting dropped by a comcast router, lag-2-240-acr07.pinole.ca.sfba

My IPIP, portocol 4 packets are going out fine. But ipip packets coming back into comcast are getting blocked at lag-2-240-acr07.pinole.ca.sfba.comcast.net.  This has been happening for a few months or so, it used to work. But it broke, and it's taken until now to figure out what's really going on.   IPIP is used like a VPN, to connect to another network using different IP addresses.  This is the message I got from the guys I work with on the other end of the connection.

Thank you!

This suggests that something is filtering out protocol 4 (IPIP)
between 169.228.34.84 and 50.79.209.150.

A traceroute from 169.228.34.84 to 50.79.209.150 using ordinary
UDP works, completing after 18 hops.  The last few hops in that
path look like this:

14  162.151.87.226  12.097 ms  12.315 ms  12.088 ms
15  162.151.79.134  12.735 ms  12.744 ms  12.773 ms
16  68.87.227.122  13.080 ms  12.983 ms  12.920 ms
17  * * *
18  50.79.209.150  37.676 ms  42.664 ms  33.084 ms

A traceroute from 169.228.34.84 to 50.79.209.150 using protocol 4
(IPIP) does not complete, and there are no responses beyond hop
15.  The last few hops are:

12  68.86.84.150  11.117 ms  12.601 ms  12.734 ms
13  68.86.94.154  11.761 ms  11.743 ms  11.340 ms
14  162.151.87.226  12.469 ms  12.162 ms  12.392 ms
15  162.151.79.134  12.757 ms  12.800 ms  12.797 ms
16  * * *
17  * * *
18  * * *

This suggests that hop 16, 68.87.227.122, is not accepting/passing
protocol 4 packets.  The hostname for that host is
lag-2-240-acr07.pinole.ca.sfba.comcast.net.