We are noticing strange behavior with patches this month (February). They are automatically installing and not waiting for SCCM. Machines have not checked in with SCCM but already have reboot prompt from Windows Update. We have seen it happen on Read-Only vdi machines and regular laptop/desktops. Windows 10 and Windows 11 would have a toast notification.