Update 2203 for Microsoft Endpoint Configuration Manager current branch is now available

Hopefully a quick one.  Since we installed 2103 we've had trouble getting SCCM to download any later releases. It just sticks on the first step saying "In Progress" and never moves on.  Looking at the logs we can see it trying and failing to download the file from the Microsoft servers.  Copying that URL into a browser and downloading it manually works fine, so the server must be using a different user/context to do the download that is being blocked.

To aid our network team in fixing this issue and getting me some juicy console dark mode action asap, can anybody tell me what context that download process runs in on the server? Local system? Service Account? Console User account? etc?  We use a web proxy service called WSS from Symantec and all web traffic on the server is proxied.  We know something is being blocked somewhere, but our network team are struggling to figure out for which user account to add rules against to unblock the download.