Spam/Spoofed email received differently by 3 users

The Exchange Online engine really is that adaptive - some of the time.

If you mean user impersonation protection in your anti-phishing policy then yes, I recently turned it on for one of my frequent targets and it may have helped - the rate of attacks fluctuates so much anyway that it is hard to tell. If you mean mailbox intelligence for impersonation then watch the feature for a bit to ensure it is not going rogue. The agent tends to view any instance of vip.user at freemail.tld as a spoof of vip.user at your-tenant.tld, even though both accounts may really belong to VIP user. Adding vip.user at freemail.tld to the trusted senders in the same policy generally fixes that, if you don't mind the risks of vip.user at freemail.tld being spoofed or hacked.