Dear @itea,

When the packet is outside the range of 46-65535 bytes, the router would determine it as Ping of Death Attack and drop the packet. Basically, the problem may be caused by network congestion and data collisions resulting in "residual packets", that is, IP packets smaller than 46 bytes in size. It is also possible that the router did receive packets larger than 65535 bytes.

Is there a way to find the source of the attacks? This started ever since it was bridged with the ISP modem and became the NAT device. it keeps coming until now.

Try capturing the packets of the WAN port with the Mirror function on the router and check if you can find the source of the attacks.

How to configure Port Mirror on TP-Link routers, https://www.tp-link.com/support/faq/528/