Howdy. I found this post because I had this or a similar issue (spanning tree "not working" when VLANs were enabled on the CRS112).
I ended up port mirroring traffic to/from the CPU and one of the ethernet ports to figure it out. Examining the traffic with tcpdump showed that the spanning tree frames transmitted out the ethernet ports were being encapsulated in a VLAN tag (I had configured an admin vlan).
The cause was a configuration error tagging traffic from the switch CPU port with the admin VLAN 99 (as in the snippet below).
Removing switch1-cpu fixed it and now RSTP is working for me.
# ingress - map untagged (i.e. VLAN=0) received packets to VLANs
/interface ethernet switch ingress-vlan-translation
add customer-vid=0 new-customer-vid=22 ports=$ethNames
add customer-vid=0 new-customer-vid=99 ports=($sfpNames,"switch1-cpu")
In response to the original poster, R/STP frames should be untagged. Conceptually, packets without a VLAN header are vlan-id=0. I would expect the switch CPU to be using a switch-specific encapsulation to send untagged spanning tree packets out specific ports and that the switch CPU port and all the switch ports are members of the default vlan-id=1. If you want to secure/isolate your admin port, you need to ensure VLAN 1 doesn't enter the switch via a trunk or a port in the default configuration.