1) Please check the settings of IIS & check IIS logs as well for the specific client machine.
2) Please confirm are you able to see the Updates in SC.
3) Ensure there is no CU required for the patch you are deploying on the server itself.
4) Check if there is any other GPO applied on this server e.g (WSUS) or any Third party AV might be blocking.
5) Check the settings are enabled for these server as well in Hierarchy settings to connect device anonymously.
6) Further you can check the deep dive flow of Steve Rachui on Software deployment on server/client side.
Hope this helps