If you got Calibre from the official CALIBRE site, it is a false positive. (There is a FAQ on this topic). If you went elsewhere
for your download you have no idea of what was added (nor do we)
Some folk call anything 'spyware'.
Calibre does 'call home' to find out if there are updates.
That call also logs what OS, which is used on the Stats page as well as takes you to the matching download page.
All this behavior IS acknowledged on the official site.