Andrea Veri commented:
Specifically, amavisd was triggering a selinux context error when that specific mail was transitioning. That was due to a config error:
/var/spool/amavis/virusmails vs /var/spool/amavisd/virusmails (and as a consequence a bad selinux context assigned)
Thanks for your report Michael, will fix this in Puppet as a next final step.