Thank you for your reply.
These are the two different cases in the log:
Content disarm and reconstruction always applies when it concerns a file. Mostly FortiMail classified it as Attachment Filter.
With remove content, unfortunately it is never specified exactly why, only that he has removed the active content.
Thank you in advance!