You would be surprised to see how easy it is to hack domestic routers.
1. Find and disinfect the devices, including the router. If you don’t have enough technical knowledge, then buy a new router.
2. Use 30 character long random password on the router.
3. Disable UPnP.
4. Anything with WI-FI and weak password can be hacked within minutes, so check your other devices as well, especially IOT ones.
Tarpitting (serving content slowly from the edge, in order to slow down bots) is necessarily one of the most expensive tools in a WAF/CDN's toolbox.
It's much more likely that something on his network is sending sketchy traffic to CF-fronted/Google sites, and the slow loading he's experiencing elsewhere is because his upstream is being saturated by whatever is happening on his network.
https://google.com/search?q=mikrotik+botnet
These things are the absolute scourge of the internet.
I don't recommend them to anyone who doesn't enjoy and are familiar with the lower-level intricacies of network operations.
It's almost certainly compromised.
UPnP allows devices inside your network to open ports to the outside world without your knowledge. I think everyone should avoid it if they can get by without it
So what's your alternative for peer to peer connections? Static routing that the common end user can't figure out? Re-centralize connections?
UPnP is necessary.
There is no "perfect" solution here because the real world is a messy place with devices that you cannot personally vouch for.