Hi,
This looks like the classic keep alive problem. Routers lose the port address translation after about 20 seconds to a minute. Ensure that in settings -> general -> global options keep alive is switched on. If you are using external extensions, then ensure that keep alives are enabled on the phone that is the external extension. Also, on settings -> network -> firwall ensure that "allow non sequential ports" is enabled. STUN as mentioned also helps. SIP ALGs on routers nearly always "break" SIP, as the ALG tries to correct SIP packets that the 3CX is also trying to correct. Good idea also to try using another port number for SIP if the provider allows it.
FInally, if you can, use a static IP address (on the public side) and configure static port mapping on the router. Then ensure you test it with the 3CX firewall tester.
Kind regards
Richard Crabb