[sbx320]

Personally I haven't been hit with spam to truly random addresses with my catchall. Is that a common issue people run into?

The spam I've received on my catchall is either based on previously breached sites (which I once signed up to) or to very common mailbox names (e.g. postmaster@, info@). I just add those to an auto-reject postfix filter based on the intended recipient, which keeps my inbox very clean.