1. URIBLs are set to 'Incoming SMTP' when they should be 'Spool Filtering'
2. A fresh install of SM17 has settings that are not the same as 'Reset Antispam Settings', the following are inconsistent;
Internal SpamAssassin (disabled on fresh)
Reverse DNS (weight and Incoming SMTP)
SPF (looks like most things are different)
Grey listing (enabled on fresh)
3. Some settings that were enabled in 16 and are highly recommended to remain enabled are now disabled;
Reverse DNS is no longer enabled for 'Incoming SMTP'
SPF is no longer enabled for 'Incoming SMTP'
And while your in there DMARC policy checking is a must.