There are many (complicated and domestic) methods of hiding your identity.
Yeah, in fact, meshes are a pretty shitty way of doing so, since you'll want encryption anyways and it's not exactly hard for a malicious person to set up a node that stores its traffic / performs MITM attacks.
Should I report, or maintain within the legal boundaries of the contract?
Ideally you would notify the client in the contract that the presence of illegal materials is grounds for you to report them. Unsure about the case where you neglect to do so.