Hi @DongleBerry-4652,
Please navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate to check which source the client is used. Here is the screenshot:
Besides, please check WindowsUpdate.log. Windows Update uses the thread ID filtering to concentrate on one particular task.
For example, here is record in the logs, Service Id is started with 7971, it means the source is from Microsoft Update.
Here is the article we could refer to:
https://learn.microsoft.com/en-us/windows/deployment/update/how-windows-update-works
If the response is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.