At the risk of ruining my solution I moved my lan sub net into the

172.16.0.0/12 block

This is used on virtual private clouds and is not publicly addressable.

since switching to this I have not had any collisions.