Group policy not stopping updates

For years I've used the Group Policy Editor to stop (some) automatic updates
Computer Config>Admin Templates>Windows Components>Window Update>Manage end user experience>Configure Automatic Updates = 2.
While a lot of updates to Windows garbage apps still would get applied, nothing requiring a reboot ever got applied ... until recently. 22H2 maybe? Anyway, I've currently got something requiring a restart and have no idea how to tell whether this is something legit or malware. Is there some way to tell what's pending? (Troubleshooter indeed says there is a pending restart for maintenance but doesn't say what maintenance requested it.)

I'm probably just going to restart. The other option is to restore from a backup I took a couple days ago, but that won't keep me from getting right back in this situation.

I restarted while disconnect2203ed from my router just in case. Cumulative update 2203-03 was installed.. Legitimate, but not on my schedule. I thought the Group Policy was supposed to prevent that.

Off topic - the Start icon now does nothing but Search can get me to settings, etc. I'm going to reboot while attached to the network and see if that fixes anything.

Update:
A restart fixed the non-functioning Start.

You can see if WU is honoring your group policy setting by going to Settings > Windows Update > Advanced options > Configured update policies.What does it say there?

Of course, it doesn't say what values are set. I think that "Notify to download updates" is the one want and the one I've had for years. Maybe the other ones are interferring with it. I'll look into that, but I don't have time right now.

If you really want to avoid Windows updates then set your network connections to metered.
And, to avoid App updates as well, use a local user account not an MSAccount-linked one.

Denis