In the event log we see automatic updates installing and rebooting the server. We thought we turned off automatic udpates prior to the last update/reboot events. When you turn off automatic updates, does it write an event to the log? If so, what is the 'source' of the log entry?
The Automated Updates client doesn't generate any specific Event Log messages when its configuration is changed. You'll have better luck locating information about how it is behaving in
%SystemRoot%\WindowsUpdate.Log, where the Automated Updates client puts most of its logging information.