I have came across similar Issue.
We have set of servers that have installed IE11 on the maintenance window (which is 2 hours of duration). After the server reboots, the scan agent detected that these servers require Cumulative updates of IE11 and downloaded the same. However, these updates where deployed previously with past dates, hence they had status "Past due - will be Installed". Within this period, the 2 hours maintenance window completed.
Now, we the issue is that, these servers got rebooted after some a day time which is outside maintenance window. In event logs we could see the reboot is initiated by System and not by ccmexec.exe. Windows update is configured "Never check for updates".
We are unable to find entries in Reboot coordinator or Windows update logs. So, how these servers where rebooted?