Anon inbound calls stopped by firewall

Perhaps not. The IP is in the channel name for chan_sip calls, but not for pjsip. Two different examples of an anonymous call from IP 10.224.50.2:

[2020-04-03 12:44:28] VERBOSE[17129][C-00000019] pbx.c: Executing [5005@from-sip-external:1] NoOp("SIP/10.224.50.2-00000009", "Received incoming SIP connection from unknown peer to 5005") in new stack
[2020-04-03 12:46:12] VERBOSE[17564][C-0000001a] pbx.c: Executing [5005@from-sip-external:1] NoOp("PJSIP/anonymous-00000022", "Received incoming SIP connection from unknown peer to 5005") in new stack

You could write your own anon context using from-sip-external as the basis, and add lines to log the IP of the calling party. There is dialplan here that shows how to get IP: Need help with multiple locations e911 - #5 by lgaetz