Exchange Transport logs show the helo command issued with no domain following. For example <,helo, instead of <,helo example.com,
To enable Exchange transport logging, complete the steps listed under "To use the Exchange Management Console to enable or disable protocol logging on an existing Receive connector" heading in the Microsoft Technet document 'How to Configure Protocol Logging'
Correlate the timestamps of the "Error gathering message data in preparation for SPA processing" entry in the DebugView log with the message in Exchange Transport logs. If the message in the Exchange Transport logs is the format <,helo, this defect is the cause of your missed spam issue.
Symantec Premium Antispam (PAS, also abbreviated SPA) is unable to process messages when the message contains incomplete header information.