I recently came across an odd situation involving Windows Server 2016 and WSUS updates.
On the WSUS server, I typically see several new Definition Updates for Windows Defender (KB2267602) every day. E.g. on 2017-11-26, Microsoft released:
The update with the highest number will supersede the others, so I only approve that one. I then install this update on my other servers, and verify that they’re all up to date with patches (0 needed).
NB Windows Defender only runs on Windows Server 2016, not Windows Server 2012 R2 (or older). I’ve only tested this on core server, not the GUI edition.