Why are there ping replies from within 172.31.0.0/16?

You are correct that 172.31.0.0/16 is part of the RFC1918 IP address space. Your router is most probably configured to dump traffic towards non-connected routes to it's default gateway, your ISP. That's where the traffic should stop.

However, it seems your ISP has made this address range routable. I've seen this happen in the past with other ISPs (Tele2 for example, used 1.0.0.0/8 for their backbone before it was assigned by IANA).

Either way, you (and your ISP) should probably implement bogon filtering and/or martian filtering on the borders of your networks. For the average home consumer, this is excusable, but an ISP should know better.

To avoid this issue, you could set up a basic outgoing filter on your router's firewall (eg 10.0.0.0/8, 127.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, and 169.254.0.0/16). Another option is to null route or black hole route these address ranges. Your router will then drop the packets.