Hi,
It's common knowledge that WU needs IE (most likely you already know this), and more to the point IE will be run by svchost.exe as parent, always, no matter how you run it yourself (likely you arlready knew this?). Could any of your app monitor rules be blocking the svchost.exe/iexplore.exe parent/child combination? ¿Maybe only in particular cases that trigger behaviour analysis?
Author