Are you performing the required WSUS maintenance? [https://www.ajtek.ca/wsus/how-to-setup-manage-and-maintain-wsus-part-8-wsus-server-maintenance/](https://www.ajtek.ca/wsus/how-to-setup-manage-and-maintain-wsus-part-8-wsus-server-maintenance/) On part 8 of my guide it mentions that you have to: ​ > On a periodic time frame (usually once a quarter), you should review the products and classifications that are enabled, disabled, and available to select. If you have a new product introduced into your network, you should select it. If you have already removed a previously selected product from your network, remove the checkbox by it. It sounds like you've got only a sub-set of products selected and there are more updates that WSUS isn't grabbing for your systems.


On the servers in question, run: wuauclt.exe /resetauthorization In an elevated command prompt, then re-detect for any updates.