Ventral Email - Plan text email with suspicious url send to large no of recipients not quarantined

We are receiving spam e-mail with a suspicious url from gmail and outlook accounts with a large number of TO recipient adresses (>300). 

There is no smart banner added as it is a plain text e-mail. Content-Type: text/plain; 

There is a plain text url present which ClickProtection recognises and rewrites to a Sophos clickable url.

Doesn't Sophos quarantine by default e-mails send to large  numbers of email adresses? Is there a way to block it?

TIA,

Fred