Private VMs using Public Cloud NAT intermittently fail new outbound connections during high concurrency. Logs indicate port allocation exhaustion. Which approach best fits?

1. Review NAT port allocation and scale the available translation capacity.
2. Use an appropriate public frontend or load balancer rather than relying on outbound NAT.
3. Treat Cloud Router as the managed control plane, not a data-plane forwarding VM.
4. Use an appropriate private API access design with explicit egress controls.