The wf_cat_id field is in FortiMail log messages where type=spam and subtype=url.
wf_cat_id
type=spam
subtype=url
The field indicates the FortiGuard web filtering category.