Sorry folks, I think i got this one on my own. Below is what I have found:
**The IIS Worker service was using high amounts of CPU. After further investigation we found the issue to be with the WsusPool Worker Process on the server. It would climb up and service a few clients and then recycle on a regular basis. We noticed the same IP addresses were in the "current requests" for the worker service each time before it crashed. It was the Windows Server 2016 servers, which were coincidentally the Advanced Threat Analytics servers (not related). **
After many searches and digging on this topic it would appear it is an IIS configuration change issue, which is reflected in the following articles:
http://serverfault.com/questions/522832/problems-with-sup-on-sccm-2012-sp1
http://blog.coretech.dk/kea/house-of-cardsthe-configmgr-software-update-point-and-wsus/
https://social.technet.microsoft.com/Forums/en-US/a629c131-1c12-4803-a479-e5c6ca784b10/sccm-wsus-failed?forum=configmanagergeneral
http://stackoverflow.com/questions/16162524/how-to-increase-memory-and-cache-size-for-application-pool-in-iis-7-efficiently
https://blogs.msdn.microsoft.com/the_secure_infrastructure_guy/2015/09/02/windows-server-2012-r2-wsus-issue-clients-cause-the-wsus-app-pool-to-become-unresponsive-with-http-503/
So here are the settings that I changed within IIS on
Private Memory Usage Increase (for Recycling Conditions)
- Private Memory Usage increase to 8388608 KB
Output Cache Increase (for response file size):
- Output Cache Settings increase to 1048576 (in bytes)
Maximum Worker Processes:
-Maximum Worker Processes from 1 to 0 (System must be NUMA aware for this and will essentially trigger as many worker processes as there are NUMA nodes).
Thanks
/Gus