NAT Keep alive packets probably don't have any SIP header.. That maybe the reason it is rejecting the packets.

Since you are working fine with the packets being rejected, I assume you don't need any keep alive packets. You could probably ask VOIPo to turn off Keep Alive packets. Since your router is SIP aware, it is getting the registration interval from the SIP packets and keeping the NAT entry alive for the duration.

I am not sure if STUN setting is turned on for your ATA. If not, your router's SIP ALG is working fine. If the SIP ALG is turned off in your router, you will need NAT Traversal and STUN server on your ATA.

On my ATA, NAT Traversal, STUN and Keep alive packets are turned off.