Based on my data, if the HELO name is an IP address in quotes, you are probably looking a Spam. Apparently your results are similar. A subset of spammers are really sloppy, so it can be useful to look for sloppy.
The big problem with parsing Received headers is that there will be more than one, and you may only be interested in the last one. If you use Declude or Declude Reboot, SmarterMail will pass the current HELO name in the .HDR file. With just SmarterMail, you may trigger on some earlier Received entries which may or may not indicate a problem.
I will assume that you are only interested in IPv4 addresses. We are looking for a pattern of the form:
FROM [10.10.10.10]
A simplified version of the IPv4 match looks for 1-3 digits, separated by dots. repeated several times.
The token \s+ is used to indicate whitespace (any type), of one or more characters.
[0-9] says any character in this range
{1,3} says the previous thing must occur one to three times.
The \[ character forces the "[" character to be treated as a literal, rather than a code.
The \] character forces the "]" character to be treated as a literal, rather than a code.
So we have
FROM\s+\[[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\]
Look at "Raw Content" from several messages to get your real-world examples, then test the guess that I have provided, using a regex testing site like regex101.com
For example, you need a switch to make the word FROM case-insensitive. The test site will help you with that syntax.