I found this explanation which clarified things a little:
I don’t know the details of what is causing these incoming bounce emails. (Is there a way to view the full email? Admin only shows the address and subject.)
But they’re never for common email services. Maybe the emails are being forwarded or something, so the initial SMTP send succeeds, so Mailgun is happy, but it bounces at the end server? Maybe the server is violating some RFC? It’s been happening for more than one user though, and sending a message to the Return-Path header is the correct VERP behaviour I thought.