Hi, @sover steve
Thank you for posting in Microsoft Q&A forum.
The behavior you are describing is likely due to the default settings for the Software Update deployment reevaluation cycle in Configuration Manager.
During this evaluation cycle, the client computer scans for software updates that were previously deployed and installed. If any software updates are missing, the software updates are reinstalled from the local cache. If a software update is no longer available in the local cache, it is downloaded from a distribution point and then installed.
This means that if a software update is made available to clients and the clients have not yet installed it, they will automatically start installing it during the next reevaluation cycle, which could occur before the deadline is reached.
If the answer is the right solution, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Add comment".