The client side of DHCP. Your device listens here for the offer that follows its address request, which is broadcast because at that moment it has no address of its own to receive a reply at. Ports 67 and 68 always work as a pair.
Not something you expose or forward. If you see traffic to port 68 from outside your network, something is wrong.
Nothing should be connecting to port 68 from outside. If something is, investigate the firewall rather than the port.
The port scanner will tell you whether 68 is reachable on a host you control. Checking from outside your own network matters: a port can be open on the machine and still be blocked at the firewall, and it is the view from the internet that decides whether anyone else can reach it.
Only scan hosts you own or have permission to test.