SCCM 1810 and Windows 10 Defender Definitions Updates

Until recently we had Auto deployment package that picks up the latest definition and deploys it our to our client based.    Up until last friday this work perfectly - it seems like we did have a bad definition that was download from microsoft and pushed out to a certain number of clients - it created a blank folder under their ccmcache folder which cannot be deleted.     Looking at the WUAHandler logs on the client when doing software updates scans - it is hit or miss or very random when it picks up our onsite WSUS server.     Does anyone know if something changed in the March 19 updates for Windows 10 that the change update behavior?    We did install the latest update for SCCM 1810.

Thanks in advanced.