I hadn't visited this thread in a while, but I'm very appreciative of all the follow-up replies. The VMware Community acts as my knowledgebase and documentation about 50% of the time. Heaven forbid they lose this data.
As for Acrobat updater and svchost.exe, in my example, Acrobat is installed natively and launched outside the bubble per the Package.ini syntax. Are you saying that the updater could have been spawning the svchost.exe instance?