I was able to resolve this today with MS support. (Thanks, Edgardo!)
What they did:
- reset the windows update tool - the tech downloaded resetWUEng.zip (https://gallery.technet.microsoft.com/scriptcenter/Reset-Windows-Update-Tool-402a3eef) - and ran (I gather this is the same a using the troubleshooter on windows update, which I did, and which resets several errors)
- Downloaded the update manually and ran:
https://www.catalog.update.microsoft.com/Search.aspx?q=KB4340558
note: I am using the 2nd download - windows 8.1 - not the server version.
- I had to go into windows update and hide the bad KB4340558
The tech thought the update that is downloaded via the regular update mechanism might be corrupted.
good luck!
Max