How do you know it isn’t WSUS? Or that maybe it was recently serviced and that part of a “shotgun blast” of attempted fixes, someone installed Mouse Jiggler and updated the system with something like Autopatcher and then forgot to do a manual reboot?