If any of you tried the steps in my post above, I am sure that you found that the next time you restarted your PC, it once again, started the update process - just as I did. Ughhh!
Well, this time, I think I have really nailed it.
Go into Services again and find "Windows Modules Installer"
Right-click and select "Properties"
Change "Startup Type" to Disabled - click apply then OK
I have now been through multiple shut-downs, start ups, and reconnecting to the internet and NO updates!
I am pretty sure this service is the "Trusted Installer" that has ownership permissions as outlined in my post above.
As a quick means to find these disabled services when you really, if ever, that is, want to do an update, you can sort by startup type in Services - this will group all the "Disabled" services together.
If you leave all three services disabled - which I have done since I really don't have time to play right now to find out if all three of these services need to be disabled or not to prevent Windows update from hijacking your PC, here is a list of them:
"Update Orchestrator Service"
"Windows Update"
"Windows Modules Installer"
HTH