dchan268 Thanks, will report it to the responsible team.
There is a Schema change with CU21 (see: https://docs.microsoft.com/en-us/exchange/plan-and-deploy/active-directory/ad-schema-changes?view=exchserver-2016#exchange-2016-cu21-active-directory-schema-changes) so you need proper permission to perform this change (it'll be performed even if you go straight to CU22).
There are also new prerequisites (IIS URL Rewrite Module and [on Server 2012 only - Update for Universal C Runtime in Windows (KB2999226)]) which are required for the newly introduced Exchange Emergency Mitigation Service.
See: https://docs.microsoft.com/en-us/Exchange/plan-and-deploy/prerequisites?view=exchserver-2016#exchange-2016-mailbox-servers-on-windows-server-2016
Please find our update best practices here: https://docs.microsoft.com/en-us/exchange/plan-and-deploy/install-cumulative-updates?view=exchserver-2016