Yeah, I never figured it out. Given that we've correctly chosen Vnstat's interfaces so that we're not including the LAN (check), and accounting for differences in the way time period reporting works between the two (check), I have to conclude that either Nlbwmon has a bug that causes it to vastly underreport over time -- or the way in which it measures is simply flawed.
I should add that in my case I haven't seen Nlbwmon outright stop, which of course would be a problem. So, unless it's stopping for periods and then resuming, I don't think I have that particular explanation for the problem. If true, Nlbwmon apparently has multiple flaws.
One thing I do know is that Vnstat accurately represents reality, because I can compare it with what the ISP shows. They're very close.
Update:
I found this thread from several years ago. The author says:
"Vnstat looks at interface traffic counters which also factor in things like local broadcast traffic, protocol overhead etc. while nlbwmon solely counts connections which are destined from the local network to remote destinations."
So, unfortunately, Nlbwmon is not really the tool that most want, since reality is reality: there always is overhead, and it always counts. I'm not sure what he means by local broadcast traffic, since that shouldn't be coming into play unless someone has misconfigured Vnstat to count the LAN, which is not what we're talking about here.
So, when someone later in the thread poses this question:
"If I understand you correctly, nlbwmon will tell me how much bandwidth I've used, as seen from the point of view of the ISP. Is this correct?"
And the author answers "Yes, that is the basic idea."
...it's a little mystifying, since while that may be the basic idea, it's not at all what's happening. A correctly configured Vnstat is dramatically closer to what the ISP perceives, and that's readily provable.
Update 2: For those seeing nlbwmon errors in their syslog, that's a separate problem but one obviously that will make the discrepancy even worse. There are two main threads on some things to try to alleviate the errors.