Intune Update Rings

We have been having a few issues where the update rings we have set for our pilot users, don't seem to be applying how we intended. I have seen a device saying its installed an update and will reboot at 7am, some devices have rebooted out of hours without a prompt also. Are there any recommendations on what we should change on the below?

We had tried using the feature rings in preview but they didn't work. We don't want any devices on 2004 but need to update any 1803's we have soon, which is why we set it to 365 for feature updates - however some 1803's say up to date and don't update to the next feature.

Sorry if I have posted this to the wrong place, new to this.

The update settings are set as below:

Update settings

Servicing channel
Semi-Annual Channel

Microsoft product updates
Allow

Windows drivers
Allow

Quality update deferral period (days)
7

Feature update deferral period (days)
365

Set feature update uninstall period (2 - 60 days)
60

User experience settings

Automatic update behavior
Auto install at maintenance time

Active hours start
7 AM

Active hours end
12 PM

Restart checks
Allow

Option to pause Windows updates
Disable

Option to check for Windows updates
Enable

Require user approval to dismiss restart notification
Yes

Remind user prior to required auto-restart with dismissible reminder (hours)
24

Remind user prior to required auto-restart with permanent reminder (minutes)
60

Change notification update level
Use the default Windows Update notifications

Use deadline settings
Allow

Deadline for feature updates
15

Deadline for quality updates
4

Grace period
2

Auto reboot before deadline
No