You can tell OJS to supply a return-path header, but your mailserver is what will ultimately determine what it allows at the return-path. As @asmecher mentions, it looks like your mailserver is creating this return-path.
I’ve found that most spam flagging is due to SPF and DMARC failures. Have you investigated these configurations?