Can you confirm that your Win2016 host is actually getting the WSUS GPO? You should be able to do this by using gpresult or checking your WSUS console and make sure that the host is checking in, etc.