CGND is external, the other side of the ethernet isolation barrier, it must never be connected to your circuit directly or you lose the isolation barrier (which for instance would blow something up if you used PoE.) Ethernet connections are transformer isolated to avoid all the issues of ground loops (and coincidentally allowing PoE to exist).