Does anyone have any suggestions on using an ons port on the CX for an off premise ext. I know it is not recommended.

Try this surge protection. The best I've ever used https://www.edcosurge.com/


Look at the H-series HAE. Get a good ground and it should be fine

I'm told that the CX ONS ports are very sensitive.