I agree that it would certainly be most likely to be something like an AV app or some other similar HIPS/security app that has to really embed itself in the OS in order to work properly.
15% of systems is a lot, so I can understand that it would be time consuming. However, just to give you an idea of my perspective on things, I cannot recall a single time in my entire career where I had to use selective startup to get Windows Updates to be successful. And then also from the BP perspective, we have never had a support ticket where the resolution involved that. I make these points only to highlight that what you’re experiencing is by no means expected or normal behavior, as far as I’m concerned.
Good luck with the troubleshooting.
-Doug