Three items:
1) group addresses and spam filtering
Long ago (5+ years) there was an issue with spam filtering not working for groups the same way it did for mailboxes. I *think* this was resolved, but if not you could create a mailbox for the group, then configure the mailbox to forward to the group. (I don't know if this would let you set the group to 'internal only' or not)
2) DNSBL
The IP that delivered the sample message you've provided is listed by several DNS BL services:
https://mxtoolbox.com/SuperTool.aspx?action=blacklist%3a67.227.172.211&run=toolpageThis could have happened after the message was delivered, but you might check to see if you want to enable one of the DNSBL services that is listing the IP (Barracuda or SORBS, perhaps)
3) RHSBL or custom spamassassin score?
The spamassassin headers are showing that the email contains known bad URLs ("2.0 URIBL_DBL_ABUSE_SPAM Contains an abused spamvertized URL listed...in the Spamhaus DBL blocklist")
You could create a custom score for this spamassassin rule, but it would be easier to enable 'RHSBL'.
Here are my qpsmtpd settings for reference:
# config show qpsmtpd
qpsmtpd=service
BadCountries=
Bcc=disabled
BccMode=bcc
BccUser=maillog
DKIMSigning=enabled
DNSBL=enabled
GeoIP=enabled
HeloPolicy=rfc
HeloReject=1
KeepLogFiles=30
LogLevel=6
MaxScannerSize=25000000
RBLList=zen.spamhaus.org,bl.spamcop.net,truncate.gbudb.net,ix.dnsbl.manitu.net,b.barracudacentral.org:Blocked - see http://bbl.barracudacentral.com/q.cgi?ip=%IP%
RHSBL=enabled
RelayRequiresAuth=enabled
SBLList=dbl.spamhaus.org,badconf.rhsbl.sorbs.net,nomail.rhsbl.sorbs.net
TlsBeforeAuth=0
UBLList=multi.surbl.org:8-16-64-128,black.uribl.com,rhsbl.sorbs.net
URIBL=enabled
access=public
qplogsumm=enabled
status=enabled