Hang on...
If you do a traceroute and try sending DHCP discover requests to some of the IPs in the trace that could be the internal "WAN" IP not the actual WAN public IP but a few hops before?
So let's say one of the potential internal IP is 1.2.3.4 then you send the request to 1.2.3.255 ?
I'm sure their DHCP server, if they have any, will not be on the public WAN IP subnet.
Disclaimer: I actually failed my first attempt at my computer networking exam back during my BE degree final semester so I'm not sure what I'm suggesting would even work.