What do you mean internal? It is capturing traffic on interfaces, it can be wan interface or lan interface.
Correct.
Well, that was more or less evident from the beginning of the troubleshooting.
You should be looking at the zone_wan_prerouting lines for traffic incoming from the wan. The other lines are not connected to your issue.
That's up to you to decide.
You're welcome and if your problem is solved, please consider marking this topic as [Solved]. See How to mark a topic as [Solved] for a short how-to.