Windows 10: Update notification on PC connected to WSUS 1809 LTSC

I have a bunch of PCs all running 1809 LTSC with the target version policy set, and which get the updates from a W2012 R2 server running WSUS. Group policy is set not to connect to any internet sites, deferrals do not cause scan against windows update, do not include drivers, and peercaching is disabled.

When I got home I found a notification on my PC saying there was an update pending. I freaked thinking it was a feature update, and wondered how such an update got to my PC. I couldn't get access - the PC was hung so I had to power it off.

After restarting, I looked at the software distribution folder and found one update - KB4570720 which is a preview update for .net. I always decline previews on wsus and the PCs group policy is also set not to install preview updates.

Seems that update was successfully installed (according to the event log), so I've uninstalled it. It was showing as a Windows update, not as a .net or preview update. This just gets weirder by the minute.

The WindowsUpdate logs showed 164 expired downloaded files purged (I guess during startup?). But I had checked the softwaredistribution folder earlier in the day and it was empty.

What I also noticed was that in the Windowsupdate logs there was nothing at all between 15:41 and when I restored the system, though I'd been using it all night up until about midnight.

I have turned off all notifications by group policy as well, but when I looked at the security and maintenance settings I can see the few that are not greyed out had been re-enabled. When I disabled them and rebooted they got re-enabled again.

To make matters worse, there are no preview updates pending on WSUS (Either set to install or not approved), and indeed, no updates at all for my PC had been approved, so where the hell did this come from, and why am I getting notifications when I Have disabled notifications?

So I checked for viruses - PC is clean.

Any ideas on what might of happened?

Tomorrow I think I'll re-install Windows just in case. But I'd sure like to be able to understand this weirdness.

:)