Text pasted in CKEditor isn't clean
For reference, there was a backwards-compatibility break in CKEditor v4.6 - it removed some of its own paste-from-Word button's cleaning. See this discussion on the Drupal side: https://www.drupal.org/project/drupal/issues/2871539

Note comment #6 there offers another workaround - responding to the 
afterPasteFromWord CKEditor event in some custom Javascript and filtering exactly as desired.