There is almost certainly no need to set up a VPN or other complex solution.
First, check the value of Contact at Reports → Asterisk Info → Peers to see whether one of the phones at a multiphone location shows the same port as its SIP local port. If so, that indicates that the router/firewall at that location rewrites the source port only to avoid a conflict. In that case, setting a unique local port on each device should eliminate this issue.
However, regardless of the above, set a short registration expiry, e.g. 120 seconds on each device. If source ports are always being rewritten, this will at least ensure that any calls received at least two minutes after an internet outage is over will be properly routed. If you can avoid rewriting with unique ports, this should ensure that a call can be received within two minutes after a router restart.
Note that some devices have different timeouts for registration retry that you may need to adjust.
If you still have trouble,
may be helpful.