Which RBL is flagging the email?

Unfortunately the logging is a bit poor for email filtering on XGS (it's been brought up before - long discussion and I'm on the side of the users) -- my tact has been to enter the IP being blocked into the blocklist checker at Email Blacklist Check - IP Blacklist Check - See if your server is blacklisted (mxtoolbox.com)  -- Sophos uses an amalgamation of several RBLs, and I've found the results I get here point to the culprit in all cases that I've had to deal with.

We also have the same problem with Email Security. Several false positive rejections due to RBL for a few days now. We use the Premium RBL group.
Support case is already open #07395296

I finally turned off Spamcop. We still have spamcop enabled on the mail server and it has the option to just increase the spam score as opposed to outright blocking it, so at worst a blocked sender will end up in the user's junk folder. 

False positives seem to have dropped significantly.

In our troubleshooting, we found many (most?) were being sent from Microsoft servers (protection.outlook.com or something). My theory is since so much of the world has given them control of their email, including spammers presumably, of course many legit senders would get blocked since they use the same servers.

Yes, I have observed the same thing. The blocked emails all came via the Microsoft O365 server.

Do you no longer have RBL active on the firewall or have you activated a different list? 

I still have barracuda and uceprotect enabled. That's all. 

Hi,

Thank you for reaching out to Sophos Community, 

Will put a note on your case and further monitor it.