I also have Xfinity and began to experience this a few years ago. When it started I configured my router (pfSense running on an APU2) to forward all outgoing connections on port 80 (and a selection of other commonly unencrypted ports) through a VPN - but leave all other ports, especially 443, alone.

I’ve been doing that ever since. It works great, and for me is a good trade-off over using a VPN for literally everything.