There should only be two RTP ports in active use. I don’t know about RTCP. I assumed it used the same ones, but, if not, I would expect two ports as well.
I don’t know for certain that Asterisk releases RTP ports when not actively using them. That would risk a re-invite back failing. Our concern is traffic, not the number of ports.
You should probably do sip show history on the connections, to see if Asterisk is attempting an external bridge. As it looks as though there is no NAT involved, the only reason for not attempting would either be that you only have early media, or that you have enabled transfers, or something else that needs DTMF to be monitored.