I'd recommend you log into ClientNet and look under Tools -> Track and Trace to check the progress of this email within Symantec.Cloud's systems.
The headers you've posted seems to suggest the delay was introduced on the last hop (between Symantec.Cloud and your mail server). I'd personally recommend checking your FW correctly allows all the Symantec,Cloud IP addresses, and if you have deep packet inspection enabled (which has been known to mess with email on occasion).
Either that or log a support case to get them to provide the full SMTP logs.
IP List here:
http://images.messagelabs.com/EmailResources/ImplementationGuides/Subnet_IP.pdf
Oh yeah, for future reference, the forums for Symantec,Cloud Email Security questions can be found below (you've posted in the appliance-based forums for the former Brightmail device):
https://www-secure.symantec.com/connect/security/forums/hosted-mail-security