Why does RCN route addresses in 10.0.0.0/8 to some public machine?

I have a colleague who uses RCN (no idea if that's relevant). When he runs traceroute on a private IP address like 10.22.32.136, it seems to get routed to some "public" machine. For example, he gets output like:

ip-192-168-1-1 (192.168.1.1)
ip-10-16-0-1 (10.16.0.1)
...aggr1.<cityA>.<stateA>.rcn.net (207.172....)
...core1.<cityB>.<stateB>.rcn.net (207.172....)
...
...aggr1.<cityC>.<stateC>.rcn.net (207.172....)
port-chan32.grg-cbr2.lnh-grg.md.cable.rcn.net (66.44.84.227)
ip-10-22-32-136 (10.22.32.136)

Am I misreading the trace or is this IP (which is designated as a private IP) being routed to a public machine? What kind of configuration would cause this on his end?

We both use the same VPN on our computers for work. But if I ping or traceroute 10.22.32.136, it's unreachable (I use Comcast as an ISP, in case it's relevant). So I don't think it's a VPN configuration.

Welcome to NAT444. That is likely intentional, IPv4 addresses are exhausted.

Demand IPv6 to restore end to end connectivity. And easy to read traceroutes.