Authorities said they had found a suspicious letter in a getaway car used by Turkish-born main suspect Gokmen Tanis, 37, which made them "seriously" consider terrorism might have been involved in Monday's rampage in which three people were killed and seven injured.
Armed counter-terrorism officers meanwhile arrested one new suspect, aged 40, in Utrecht on Tuesday who was "suspected of being involved in the shooting incident", prosecutors said, adding that his "role was being further investigated."
Two other men who were arrested Monday in connection with the shooting had been released, prosecutors added.
Dutch Prime Minister Mark Rutte earlier in the day laid flowers for the victims at the scene of the attack and said he was "still filled with horror" by the bloodshed.
"So far, a terrorist motive is seriously being taken into account. This is based on a letter found in the getaway car among other things and the nature of the facts," Dutch police and prosecutors said in a joint statement.
Apparently ruling out reports that the shooting was due to a family dispute, the statement added: "Our investigation has established no link between the main suspect and the victims."
The three people who died in the shooting were a 19-year-old woman from Vianen, south of Utrecht, and two men aged 28 and 49 from Utrecht itself, the statement said.
Armed police captured Tanis after an eight-hour manhunt that virtually shut down the Netherlands' fourth largest city and saw security stepped up at airports and key sites across the country.
Police said they found a red Renault Clio that the suspect had carjacked before the attack and used as a getaway car afterwards. They had also found a firearm after his arrest.
Tanis is expected to appear before a judge later this week in a closed-door hearing after which he most likely will be remanded in custody.
A stream of mourners laid flowers on Tuesday at the site of the attack near the 24 Oktoberplein square.
"One of the victims was my friend's girlfriend. So coming here today was the least I could do," Marco van Rooijen, 43, told AFP.
The attack raised security fears ahead of Wednesday's provincial elections in the Netherlands. Populist and far-right parties have seized on the attack to push their agenda for the polls but Rutte has remained restrained.
"A day later, I am still filled with horror," Rutte told parliament.
"There are still many questions about the motive, and the police and prosecutors still have to do a lot of work. But there is no doubt that the impact was huge." Flags were flying half-mast on many buildings around the Netherlands and on foreign embassies.
Public transport was running again after forensic police finished their investigations at the scene and removed the tram on which the shooting erupted.
But there was also growing anger after it emerged that the suspect had only been freed from jail in a rape case two weeks ago.
Tanis was originally arrested in 2017 then released from pre-trial detention, before being taken back into custody when he breached his bail conditions, the central Netherlands district court said.
He was freed again at the start of March.
In 2014, he was also convicted of "illegal possession of weapons" and attempted theft but acquitted of attempted manslaughter. He was also convicted in recent months for shoplifting and burglary.
Broadcaster NOS meanwhile said some of his relatives had links to fundamentalist Islamic groups, but also that he was known for unstable behaviour after divorcing his wife two years ago.
A woman involved in the rape case told the Algemeen Dagblad newspaper: "He is completely mad and uses drugs. I have previously warned the police against him. He's not a terrorist but a psychopath." Support for the Netherlands poured in from around the world, including the United States, the EU and Russia.
US Secretary of State Mike Pompeo said: "America stands with you. We will continue to do all we can to help you in this terrible time of tragedy." Turkish President Recep Tayyip Erdogan said his country's intelligence agency was "looking into" the attack.