I can confirm this is 1000% related to gmail.
I have evidence for it as well..
A few days ago, I was testing email delivery. While most people’s gmail received the test mail in the updates section of gmail,
Some of those were sent to spam with suspicious email warning highlighted on the top of it saying “emails like this are used for phishing attacks, proceed with caution”
It was the same discourse, same email (mailgun) and same mail (test email from admin) and still gmail manages to handle them differently from user to user basis. I don’t find any pattern either because there were mixed results for either registered or unregistered users.