We have done some more test and some machines still failes even with the latest patches on 1709.
But if we disable VT-d so the update continues and then update 1803 with the latest patches we can enable VT-d again after.
Good.
Can you try to upgrade to 1809 or latest Insider Preview?
Also, is it possible to integrate it into a bootable iso?
Since 1803- 2018 Oct. patches, all my problem machines> Lenovo-S20-Xeon, MSI-i5-2400, HP-Compaq-i2-quad.
were cured after a total reinstall Win1803 Sept-Oct. Neither with nor without VT-x, it didn't really matter on my machines regarding the freezing on 1709 and early (first) 1803 updates.
Lenovo Yoga i7 Laptop was not affected by the freeze issue and survived all problem updates.
I am on 1809 currently with all machines mentioned above working fine, and indeed since 1809 boot and appear to work a fair bit faster, specially on the older CPUs. The Xeon S20 workstation having been the most sluggish after the Intel security patch. Meanwhile, there seems to be a faster workaround for the Intel CPU security issue within late 1803 and 1809 updates.