Hi,
rfc1918 means the sender IP address is a private IP address and hence there is no known reputation score for it.
Senderbase can only provide reputation scores for public IP addresses. If you feel these emails are spam you would need to locate the internal senders of these spam emails, I would suspect these to be outbound emails.
If these are inbound emails then you may have another device placed before the ESA which is hiding the original sender IP and you may want to look at configuring an incoming relay.
To take action on spam emails you would need to review the device configuration under Mail Policies -> Incoming Mail Policies -> Anti-Spam and ensure action for positive spam is set to quarantine.
Thank You!
Libin Varghese