Windows Modules Installer Services state change automatically

Question

Hi,

As we are using splunk to perform our log management, we have stumble upon a log entry where it state that "Windows Modules Installer Services was changed from autostart to demand start, and back to autostart".

I would like to ask whether service state change occur due to the machine automatically look for available patches or what might have also cause it change the state.

I currently am working in an environment where we perform patches manually by detecting available patches via MBSA scan before downloading the patches via Microsoft catalogue.