Oh! To me, CLI = Command Line Interface, CLID = Calling Line ID.
This can get complicated depending on how your carrier authenticates your SIP calls. Some carriers use PAI for authentication and some will insert PAI as CLID when handing to the final destination. If you strip the CLID from the "from" message your carrier may reject the call. You may need to consult the carrier if calls fail to authenticate.
For starters, set the global command sip privacy or ip sip privacy depending on your AOS version and restrict CLID on the originating trunk, see if that does it. You may also need to tweak the sip grammar commands of sip grammar default-privacy and sip grammar restricted-privacy.
In rare cases on the outgoing SIP trunk I've had to add the following:
match dnis X$ substitute *67X$
There is some trial-and-error involved depending on the carrier and how the call is presented to you. Be sure that you add a valid number to emergency CLID so that calls to 9-1-1 aren't blocked. Under the SIP trunk, caller-id-override emergency-outbound [your main number]
