FYI windows update for business is now a thing

And it uses direct public access to microsofts cdn to push updates set via polices in intune or memcm. It could be the case here and it's usually used by msft customers to avoid clogging vpn with patching bandwidth

Source:

Msft employee

https://docs.microsoft.com/en-us/windows/deployment/update/w...