I know CMake suggests to put the unversioned filename in front for the find_program() call:

NAMES
Specify one or more possible names for the program.

When using this to specify names with and without a version suffix, we recommend specifying the unversioned name first so that locally-built packages can be found before those provided by distributions.

But in the case of python files this is counterproductive. When you want to build a project for Python 2 where both Python 2 and 3 are installed, this call always finds the default f2py:

At python-control/Slycot#81 this lead to a hard to track down free(): invalid pointer error in the python2 packaging for Arch Linux and OpenSUSE, because the wrong f2py was used. As a workaround one can provide the path to the correct executable by adding the variable explicitly during the build call:
python2 setup.py build -- -DF2PY_EXECUTABLE=/usr/bin/f2py2

I suggest putting the unversioned filename to the end of the find_program() call and additionally making sure that the f2py is from the correct numpy.