Filtered by "router" virtual_user_filter HUH? Where to start looking?

In Mail Delivery Reports, I'm trying to track where on earth the "filtered" is coming from as laid out in the table at the bottom of this post. I've looked in the following places as no luck as yet: Using the UI:

• Global Email Filters
• Email Filters
• Spam Filters

Using SSH: `/etc/vfilters/domain.tld /home/username/.cpanel/filter.yaml /home/username/.filter` The most common google search on this was resolved by "recreating hosting and email accounts". I'm not willing to do that! This user has had this account for over 5 years, and the hosting account has 100s of other emails. Report:

Event:	filtered https://mail.kingsley.co.za:2087/cPanel_magic_revision_0/cjt/images/icons/filter.png
Sender User:	-remote-
Sender Domain:
From Address:	accounts@REDACTED.SENDER.DOMAIN
Sender:
Sent Time:	Dec 9, 2019, 4:46:16 PM
Sender Host:	mailer148.gate85.rs.smtp.com
Sender IP:	74.91.85.148
Authentication:	localdelivery
Spam Score:	4.9
Recipient:	anton@REDACTED.RECEIVER.DOMAIN
Delivered To:	/dev/null
Delivery User:	REDACTED_HOSTING_USER
Delivery Domain:	REDACTED.RECEIVER.DOMAIN
Router:	virtual_user_filter
Transport:	bypassed
Out Time:	Dec 9, 2019, 4:46:16 PM
ID:	1ieKJB-0003Az-JB
Delivery Host:	localhost
Delivery IP:	127.0.0.1
Size:	81.29 KB
Result:	Filtered