In addition to what @Shad0wguy posted, your golden image should be developed on an isolated network, or at least one that doesn’t have internet access for just that reason. You don’t want windows updates to help you “fix” your system while you are preparing for it. If you are doing this in audit mode, for sure disable the windows update service until just before sysprepping it. I myself use MDT to build the golden image so one of the task sequences is to update the windows updates from our WSUS server and not to use direct internet updates. That way the updates are applied and completed in a known state before MDT exits. We will typically sysprep and capture with FOG right after MDT finishes.
But its great you are documenting the problem here and the potential solution. Because if you have the issue there are 100 other folks that will have it in the future. So thank you for helping them out too.