Only the first three fields of this log file are text. The fourth appears to be portions of raw emails. In order to make sense of a given line, you would first need to reassemble the email by identifying the lines that belong to the same message. The leading fields surely provides the necessary information to achieve that. Then you may process the message as any other mail client would, and properly decode text if it is text.

I doubt that the last field of the first line and the last field of the fourth line contain text. They appear to be part of the payload of non-text emails. It's no surprise that you run into problems if you treat them as text.

The last field of the second line and the last field of the third line appear to be email headers. You would have to reassemble the message to decisively determine the encoding used by each message, but both appear to be encoded using cp1252. By no means does that mean that every email you logged used cp1252.

Update: Added first paragraph. Phrasing improvements elsewhere.