This had more to do with how we were reading headers of the email while we're in the middle of the SMTP session. Most servers buffer the socket data containing the headers and send them in big chunks which our text parser was able to handle. 2 of the gateways Webio was using had behavior I haven't really witnessed any servers do. They were sending the header lines in small pieces which broke only the part that does spam checking DURING SMTP because it's referencing data off the socket, once it hit the spool/drive the data is fully written. I guess I got bit technical with this but I ended up fixing the code that handles the incoming bytes by making a fake server that sent the bytes in a predictable manner that I could replicate the issue Webio had.

Still not sure why those servers would do that, maybe something at the network device level, maybe some network layer security stuff, but ultimately that won't be an issue anymore. This also could have affected other checks in a minor way like DMARC at the smtp level breaking because it can't read the "From:" header right. In this case it wasn't reading the "X-SmarterMail-SmartHostSpam:" correctly.