@MTR The problem with it on active calls would indicate that its definitely a NAT issue but also that session timers are enabled, some carriers set this, you will see it in the invite or 200OK, Session Expires, I think the header is.
Remember, once the session is established, only UDP RTP is flowing and there is no activity on the SIP channels.
The router is probably closing down the SIP NAT tunnel. An easy fix is usually to drop the registration time down to about 120, that's usually good as the phones will typically register at half the time like with DHCP so this works around at about a minute. That will refresh the NAT tunnel and should allow the inbound RE-INVITE through.
A very quick way to check your reg timers are too high is to take a quick print screen of the sip registrations page, this only works with PAT...
Give it a few minutes until the phones have reregistered the go and take a look again at the registrations page. Compare the port numbers.
If you see the port numbers are different this would indicate exactly what has been described and the new register has been established on a different port.
What you want to do is bring down the reg timers until the port remains the same and then you have cracked it.