on my test server (details) I am observing mta-sts-policy requests of other servers without any emails being sent after the request. Asking the owner for the email server software being used, mailcow was the answer.
To me it looks like the mta-sts policy code of mailcow blindly refreshes the cache (and the test server instructs to use 5mins only) rather than obtaining the policy only when there is an email to be sent. With a DNSSEC aware resolver, the cache only improves security when the destination does not use DNSSEC. Therefore I suggest not to refresh the cache when the destination uses DNSSEC and their is no queued mail.
Without DNSSEC one has to trade caching effort vs. security. Blindly refreshing all destinations doesn´t scale well.