moo
If you want to avoid back and forth with the ISP you basically need to single test every part of the chain. Your side Coax, Modem, Router, Cable, Device.
Connect directly to modem on 2 different devices and 2 different cables. Since your intranet speed test seemed ok maybe not much concern here, but this is for the ISP. They will ask you to use another device, another cable. If you see same speed diff across that then you maybe have a good case for them to help diagnose.
Check for splitters, or other coax hops on your end of the line. If you don’t have other coax things like TV then just remove those. If speeds are good direct on modem, then it’s likely your router. Not sure what its specs are but many consumer routers are just not up to the task of how many clients a home has these days. You can maybe test with just one thing running on the router, if there is a lot of other traffic going its speedtest may just be slow on both ends.
I myself have gone through this struggle of latency, and poor sporadic performance, upgraded to more enterprise level gear, separate router, switch, and AP to split compute and traffic more effectively. For me this lowered my overall ping, and I typically always see at or > then my advertised speed but that of course if very location/ISP/time of day dependant.
tl;dr: Test everything, prove its the ISP end, then they will help you diagnose and figure it out, if not time to upgrade
Caffe Lusso in Redmond, WA is my go to. Super consistent, super fresh. Not sure what outside WA orders look like but when I order a bag I get one that was roasted that day.
I think a lot of the suggestions here pretty solid; you can essentially do them all. I ran a similar setup, but it was not double NAT just data capped so I had to toggle my MAC every now and then.
If you do introduce a switch from the wall, you can at least get your gaming devices directly on. You can then run Wifi network off the router for your phone, and WiVRn.
As others have mentioned though these terms are there for security, your WiFi is a risk to the network. If the school is on your side and you are prepared to mitigate that risk by keeping the router updated and choosing strong auth, you could even tune the transmit power and rssi drop off but I have a feeling if they understood you were going to run WiFi and not just a switch they also would have said no.
So this setup could put you at risk of losing internet I guess according to those terms