I get a lot of these, but got two concerning ones yesterday. They were both to/from 'catch all' addresses at my domain (hosted on G Suite) and had passed SPF a

I get a lot of these, but got two concerning ones yesterday. They were both to/from 'catch all' addresses at my domain (hosted on G Suite) and had passed SPF and DMARC. I looked at the headers, and they originally came from an Ecuadorian consumer ISP and failed SPF and DMARC, but then they somehow got forwarded within/by Gmail making Gmail see them as legitimate. I've never encountered this before but I'm guessing G Suite does something funky with catch all addresses that causes them to be forwarded within Gmail itself and then appear legit?