I need to review thier setup here, but the WSUS is seperate from the SCCM server. They do all of the configuration and updating using the SCCM. But it appears to me that the WSUS downloads the updates when instructed and the DP's get the package from the WSUS. The SCCM package name is a folder containing the updates for the package residing on WSUS after you initiate a download of updates.
When you remove updates from a package it gives you the option to delete from the DP's. If you select this option it removes from all DP's and the WSUS package folder. My guess is this option has not always been selected thus updates are left behind and continue to reside and sync with the DP.s.