Thanks for your assistance.
Give me a bit of time, with everything else (ie. work) going on, to
implement and test your recommendations (and to review some
I'll post back as soon as I have something definitive.
On your query on pyzor, much like razor and dcc, it is called as part of
the spamassassin checks when present. These constitute the 'remote'
checks that one can perform when using SA. This is why I find it curious
that there were no avc messages for razor and dcc. All of these were
installed when SELinux was enabled initially.
Thanks again for your insights.