The only possibilities here are that the user initiated the update installation or the deployment is set to use UTC and thus there's a mismatch between your expectations and the time they should install. Also note that maintenance windows are 100% irrelevant here as they never cause deployment enforcement.
To clarify here as well, how do you know the updates installed early?