Hello Jonathan Wong,
First, in your console, go to Software Library > Windows Servicing > Servicing Plans, make sure you don't have any existing one.
How are you managing your devices (SCCM only, co-management, tenant attach...)? Are you using any workload with Microsoft Intune?
If you devices have full internet access (e.g. roaming clients) and they meet the Windows 11 requirements, they can receive features updates from Microsoft Update using the following option. But there is a way to disable this option using GPO.
To disable Windows Update from Internet sources, see the following documentation:
Regards,
Youssef Saad | Blog: https://youssef-saad.blogspot.com/ | LinkedIn