Which has led to something a bit drastic but I haven't looked back - blocking all Windows IP's on router level for the VM address space. I still run updates every few months.
Edit: If anyone want's a list of IPs here's one that I use and is maintained somewhat regularly : https://github.com/crazy-max/WindowsSpyBlocker/tree/master/d...