There are dependencies on updates. A great example is KB5027219 which has a dependency on KB5023788 for Windows Server 2016 which equivocates to an older version of Windows that has made its way through the update cycles. When I ran the Malicious tool, it apparently found an issue (this one) and it gave the update the access to the earlier version. When the 788 ran, the 219 was able to run because the former is dependent upon the latter.
It could be a rabbit hole but my 2545 issue has been resolved and this approach was the only one I took. My updates were misbehaving; I tried SFC /Scannow and DISM and the extreme of removing the SoftwareDistribution folder and without any result. It didn't occur to me the problem might be a missing udpate. Running the tools pushed the previous KB.
Worth a try. Another way to approach it is to look up dependencies and make sure none is missed. Seems to work for me. The MDM issues have resolved.