Unpredictable WSUS update behavior or I just don't understand the WSUS process.

Question

Last month I had started a thread about random WSUS clients failing to download updates and generating 403 errors. I am seeing the same behavior this month with a new wrinkle.
The machines that generate the 403 errors 1). do not have any connectivity or permissions issues preventing them from accessing the WSUS server, 2). the failed machines appear to be random and 3). the failed machines are usually less than 15 in number out
of 400+ identically configured and connected machines receiving updates. This month when the first batch of servers where scheduled to start downloading the approved updates all but 9 successfully download, rebooted and restarted completing the update
process. The remaining 9 (a different 9 from the previous set) failed to download every update again with phantom 403 errors.
That was last week. This week I opened my WSUS server console only to see the machines that were previously updated and removed from the "failed or needed" list reappear
in that list. Apparently the WSUS server has spontaneously decided that several past updates from 2012 to present are needed by these machines and as these updates were previously approved years ago the client machines have started downloading these updates
 and in some cases rebooting. This is particularly distressing as a). these are production machines that have a set reboot schedule and per the GPO should not reboot off schedule, b). The WSUS synch is only performed one time a month to prevent
multiple update processing and reboot cycles and c). The spontaneous updating has created even more failed machines. Some machines are failing updates that were reporting as installed last week. Due to the erratic behavior and the apparent age of some of the
updates I performed a WSUS reset by stopping the update service, deleting the old update folders from the WSUS server update directory, restarting the service and issuing a
WSUSUtil.exe RESET to re-download the required updates from Microsoft. The WSUS server is a VMWare hosted VM with sufficient HD space and memory available.
I have a total of about 2500 machines that receive updates from this server at different scheduled times during the month. It is not always possible to accommodate this type
of erratic behavior and stay on schedule. Any help would be greatly appreciated.

Answer 1

I have not been able to find any sub-status codes for the 403 errors. IIS logs only list 200 and 206 codes, no errors any any IIS logs and full logging was enabled at IIS setup. Clients only list the following:
2015-03-23 00:48:02:537  908 1524 Report REPORT EVENT: {09378F5D-2A95-457E-8FF9-A8B95E14A272} 2015-03-23 00:47:57:522-0700 1 161 101 {316E6D51-C2C7-4E94-9CA7-F8C8D6A526AF} 202 80244018 AutomaticUpdates Failure Content
Download Error: Download failed.
2015-03-23 00:48:02:537  908 1524 Report REPORT EVENT: {2822694A-146B-4CDD-A29A-118B2BDAD8AC} 2015-03-23 00:48:00:725-0700 1 161 101 {562DC25C-D769-464F-BAC6-FA26703E6E14} 204 80244018 AutomaticUpdates Failure Content
Download Error: Download failed.
2015-03-23 00:48:03:912  908 1488 DnldMgr WARNING: BITS job {9E1A23C2-A960-44DF-8FA7-CC84E7345235} failed, updateId = {77A8936E-B99A-43AD-8160-18B6F6F8CE14}.202, hr = 0x80190193, BG_ERROR_CONTEXT = 5
2015-03-23 00:48:03:912  908 1488 DnldMgr   Progress failure bytes total = 0, bytes transferred = 0
2015-03-23 00:48:03:912  908 1488 DnldMgr   Failed job file: URL =
http://10.10.10.247/Content/6D/6BDA4FE99B3A77E3120BAB7C3F2EA6A38275516D.exe, local path = C:\WINDOWS\SoftwareDistribution\Download\8b32b2da2afa677aae1aeff219ee7373\windowsserver2003-kb3039066-x86-enu.exe
2015-03-23 00:48:03:912  908 1488 DnldMgr Error 0x80244018 occurred while downloading update; notifying dependent calls.
2015-03-23 00:48:03:927  908 e40 AU >>##  RESUMED  ## AU: Download update [UpdateId = {50CBA085-5E3A-4C26-A77D-785AD55FE271}]
2015-03-23 00:48:03:927  908 e40 AU   # WARNING: Download failed, error = 0x80244018
Error = 0x80244018 is just a generic 403 and I cant find the root cause anywhere. I have run the WSUS client diag and server debug utilities, both systems pass. At this point I am at a loss.