Hello MusikAnimal
First of all, regarding Google group mailing lists, they are somewhat "elitist".
Supposedly, it is possible to use those mailing lists without a google account, but in practice my experience is that it varies between requiring jumping through some hoops (if you actually find the needed hoops) to not possible at all.
Second, if you hosted a wikimedia mailing list on Google groups it would not be possible to manage the subscription on
https://lists.wikimedia.org, it wouldn't be listed there, nor would their archives...
Not to mention it might have implications to the privacy policy.
As for the actual spam problem. I don't know which list you are referring to but, is it allowing open posting? Does it need to allow that? Are they going through or getting stopped? In my experience, allowing only the subscribers to post to the mailing list is the most effective antispam measure.
It should be possible to configure spamassassin to include the X-Spam-Score header even for lower scores (and thus filtering mails with lower values), although I would focus first on why it is not giving them higher score, or other traits that could allow blocking such messages.
Regards