Something has changed in 1803 and disabling the windows update service in the master image doesn't stick when logging into the linked clone. I've seen the service turn back to Manual (Triggered) and that kind of makes me think eventually Windows Updates will scan. I've gone ahead and added some registry hacks, but has something changed in this version that I am unaware of? Anyone know how to turn it off completely? I only want to enable it when I patch.
One thing you can try is setting the following Services to Disabled aswell
Windows Modules Installer
Background Intelligent Transfer Service
We found with these services set to manual windows would re-enable the Windows Update service just like you are experiencing.