[kamkazemoose]

I'm not sure at what layer it would be visible that the packets are ntp monlists? The basic answer is probably that the providers just aren't filtering at that level, like if you need layer7 visibility, they don't want to do dpi on any packet that crosses their boundary. Even if you don't need L7 visibility, it would still require another element of processing and filtering that they might not be interested in doing since it will almost always result in some extra cost to run.