Hello,
When you select "never check for updates", it means you disable the Auto Update. But the update behavior still can be triggered by action or command/script.
Is your client in a domain? Is WSUS used for managing the update? We could troubleshoot from the Group Policies and windowsupdate.log. The Group Policies would tell us the current policy for updating and the log would tell us how the behavior is triggered and
where the updates are taken from. You could upload the GP result and log to Onedrive and paste the link here.
However, if you want to totally prevent the client from being patched, you could remove the WSUS server (if have) from policy and enable the policy: Do not connect to any Windows Update Internet locations.
Hope my answer could help you and look forward to your feedback.
Best Regards,
Ray
Please remember to mark the replies as answers if they help.
If you have feedback for TechNet Subscriber Support, contact
tnmff@microsoft.com.