That’s your problem. Asterisk knows that it’s listening on 5060 and also knows that its public IP is what xxxx.duckdns.net resolves to. So when it responds to extension 1000’s INVITE with a 200 OK, the Contact header is effectively xxxx.duckdns.net:5060, the phone sends the ACK there, it never arrives and the call drops.
The simple fix: In Asterisk SIP Settings, chan_pjsip tab, change Port to Listen On from 5060 to 8765 and restart Asterisk. In the router, change the forwarding to 8765 → 8765. Unfortunately, you will have to change all your internal extensions to register to port 8765.
It’s technically possible to have different external and internal SIP ports, but there are some subtle issues and I don’t recommend it.
Using the standard range of 10000-20000 is somewhat more secure.
BTW, your log did not contain a SIP trace. To provide one in the future, confirm that you see
PJSIP Logging enabled
when you turn logging on, and don’t change any settings (reload turns logging off) from then until you have made your test call.