I've found the solution myself. You need to enable spread spectrum for the DCU, not the TCON. In CCM_CSCMR1 you can select PLL1_PFD2 as DCU clock. Then you can enable spread spectrum for PLL1 in ANADIG_PLL1_SS:
clrsetbits_le32(&anadig->pll1_ss, 0xffffffff, (1 << 15) | (4400 << 16) | 11);