Client Error Sequence in 1607 > 1809 Upgrade via WSUS - error 0x8024200d

Hi,

Basically, I've got so much information and at this point, I don't really know where to start with it. An important thing to note, is that these upgrades of 1607 to 1809 (deployed 17763.107.101029-1455.rs5_release_svc_refresh_CLIENTBUSINESS_VOL_x64FRE_en-us.esd via WSUS) have been successful on ~85% of the ~400 clients targeted. Many of the computers that were seeing the same (or similar) sequence of errors have successfully completed with no intervention. Still, some of them are still looping through these errors and restarting at inopportune times (when the user is logged in, but the machine is locked even though the "No auto-restart with logged on users for scheduled automatic updates installations" GPO is in place)

Here's what I've done to troubleshoot:

1. Server 2012 R2, WSUS 6.3.9600.18838. Confirmed that WSUS and the requisite updates for feature upgrades are installed. Well, almost. I have the .esd application/octet-stream mime type enabled, and a superseding update (KB4489881) is installed. So, this supersedes KB3095113, but does it supersede the "hotfix" version of KB3095113? All that said, feature upgrades are syncing and are successfully deploying with just these few exceptions.
   
2. Stopped Windows Update service on the client and renamed the SoftwareDistribution folder to .old., restarted WU service.
3. Disabled all non-microsoft startup services.
4. Confirmed that the WU registry settings reflect what's in the WSUS GPO.
5. Confirmed HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing is 0x00023c00
6. Disabled Symantec Endpoint Protection, tried again
7. Removed temp files

I honestly can't remember whether or not I ran the Windows Update Troubleshooter in this particular machine or not. That said, I'd really rather fix it myself so I can maybe solve the cause of problem as well as the problem itself.

I've been through several different forums where different things are suggested and I often see the "(Unable to Find Resource)" events addressed, but I haven't seen anything in forums (or in the Resolution procedures that directly addresses the errors I'm seeing. Here's an example of the string of errors shown on one machine when running the report in WSUS and clicking the "failed" link:

[machinename.domain.local]
Feature update to Windows 10 (business editions), version 1809, en-us x64
Event reported at 4/8/2019 11:08 PM:
(Unable to Find Resource:) ReportingEvent.Client.167; Parameters: Feature update to Windows 10 (business editions), version 1809, en-us x64

[machinename.domain.local]
Feature update to Windows 10 (business editions), version 1809, en-us x64
Event reported at 4/9/2019 1:07 AM:
Installation successful and restart required for the following update:
Feature update to Windows 10 (business editions), version 1809, en-us x64

[machinename.domain.local]
Feature update to Windows 10 (business editions), version 1809, en-us x64
Event reported at 4/9/2019 7:57 AM:
(Unable to Find Resource:) ReportingEvent.Client.181; Parameters: Feature update to Windows 10 (business editions), version 1809, en-us x64

[machinename.domain.local]
Feature update to Windows 10 (business editions), version 1809, en-us x64
Event reported at 4/9/2019 8:00 AM:
Installation Failure: Windows failed to install the following update with
error 0x8024200d: Feature update to Windows 10 (business editions), version 1809, en-us x64

[machinename.domain.local]
Feature update to Windows 10 (business editions), version 1809, en-us x64
Event reported at 4/9/2019 8:03 AM:
(Unable to Find Resource:) ReportingEvent.Client.181; Parameters: Feature update to Windows 10 (business editions), version 1809, en-us x64

[machinename.domain.local]
Feature update to Windows 10 (business editions), version 1809, en-us x64
Event reported at 4/9/2019 8:03 AM:
Download succeeded.

[machinename.domain.local]
Feature update to Windows 10 (business editions), version 1809, en-us x64
Event reported at 4/9/2019 8:03 AM:
(Unable to Find Resource:) ReportingEvent.Client.167; Parameters: Feature update to Windows 10 (business editions), version 1809, en-us x64

In WindowsUpdate.log, the most common error I see is

2019/03/27 13:41:32.5086982 1416  4324  ComApi          ISusInternal:: DisconnectCall failed, hr=8024000C

So, at this point I'm afraid that this is happening because the "hotfix" version of KB3095113 isn't installed. Or is it? Since I have the most current superseding update of the "Update for Windows Server 2012 R2 (KB3095113) installed? Since the upgrades are successful on the vast majority of machines, I'm second-guessing that and I don't want to have to delete/re-sync all of these updates if that's not the problem. Any help on how to resolve this and/or reconcile the fact that the update is working on the majority of machines in the environment would be greatly appreciated.