In short, the ISP can see everything outside the tunnel and nothing inside. The IP headers tells the destination i.e. the other endpoint of the tunnel, and TCP or UDP headers may reveal the protocol with a standard port.
On a single VPN server the IP address on the other end of the tunnel is typically the same that is used for the connections leaving the server. With commercial VPN providers you might even be able to "switch locations", which technically means your traffic comes out on a different IP addresses i.e. gets internally routed in their systems. More importantly, it gets mixed with the traffic from other customers, increasing anonymity.
Everything from network layer L3 and up goes through all the routers between the source and the destination. That means the IP addresses, port numbers and unecrypted application layer protocols etc. are seen by every router in between. The MAC address is part of a data link layer L2 protocol and is only seen by the next node. With VPN, there's a new set of L3+ stack that goes encrypted inside the tunnel.