Conflicting Reports Between Devices and Activity Log

When a patching policy runs, it makes multiple attempts to install all patches. If one patch fails to install in the multiple attempts, it might show in the activity log as the entire patch failing.

The Windows Update GUI can also be misleading sometimes, and not show an update as installed when it actually is. You can verify if an update is actually installed on a device by using the Get-Hotfix cmdlet. More information about this cmdlet can be found in this Microsoft documentation: Get-Hotfix