Once I turn the Proofpoint tags off that behavior stops and no Arabic / charset="windows-1256" encoding.
Since if turning off the tags, the issue will no longer occur, to me the cause may still be with Proofpoint.
I would suggest comparing email headers of two incoming messages from the same sender (for example outlook.com), one with tags added and one without tags.
Then check the charset of the messages to see if the tagged one becomes windows-1256.
If yes, this change may possibly be done by Proofpoint and better consider their support for further investigation.
If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.