Description of problem:
pgrep is being called by spamassassin's sa-update, which fails because of this error. 
In turn, sa-update is called nightly by systemd sa-update.timer. 

You probably already know about this problem; it's been happening for months. I was too busy/lazy to check the bugzilla. If so, my apologies, and thank you for your work.
SELinux is preventing pgrep from 'sys_ptrace' accesses on the cap_userns labeled spamd_update_t.

*****  Plugin catchall (100. confidence) suggests   **************************

If you believe that pgrep should be allowed sys_ptrace access on cap_userns labeled spamd_update_t by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# ausearch -c 'pgrep' --raw | audit2allow -M my-pgrep
# semodule -X 300 -i my-pgrep.pp

Additional Information:
Source Context                system_u:system_r:spamd_update_t:s0
Target Context                system_u:system_r:spamd_update_t:s0
Target Objects                Unknown [ cap_userns ]
Source                        pgrep
Source Path                   pgrep
Port                          <Unknown>
Host                          (removed)
Source RPM Packages           
Target RPM Packages           
SELinux Policy RPM            selinux-policy-targeted-39.3-1.fc39.noarch
Local Policy RPM              selinux-policy-targeted-39.3-1.fc39.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     (removed)
Platform                      Linux (removed) 6.6.13-200.fc39.x86_64 #1 SMP
                              PREEMPT_DYNAMIC Sat Jan 20 18:03:28 UTC 2024
                              x86_64
Alert Count                   8
First Seen                    2024-01-25 00:00:02 CST
Last Seen                     2024-01-27 09:14:24 CST
Local ID                      b357b170-4ff7-4443-b7ee-a9ef658c7f9e

Raw Audit Messages
type=AVC msg=audit(1706368464.585:212): avc:  denied  { sys_ptrace } for  pid=24832 comm="pgrep" capability=19  scontext=system_u:system_r:spamd_update_t:s0 tcontext=system_u:system_r:spamd_update_t:s0 tclass=cap_userns permissive=0


Hash: pgrep,spamd_update_t,spamd_update_t,cap_userns,sys_ptrace

Version-Release number of selected component:
selinux-policy-targeted-39.3-1.fc39.noarch

Additional info:
reporter:       libreport-2.17.11
reason:         SELinux is preventing pgrep from 'sys_ptrace' accesses on the cap_userns labeled spamd_update_t.
package:        selinux-policy-targeted-39.3-1.fc39.noarch
component:      selinux-policy
hashmarkername: setroubleshoot
type:           libreport
kernel:         6.6.13-200.fc39.x86_64
component:      selinux-policy