Hi,
The SPF reject usually means the service is still submitting mail to PMG on the external SMTP port 25, where SPF checks are applied. Could you please configure the internal service to use PMG as smarthost on the internal SMTP port, default 26 [0], and retest?
If it must use port 25, add...