SCCM primary server sending large amount of WAN traffic directly to client machines

Hey everyone,
 
I'm troubleshooting an issue in my environment, where an SCCM primary server is periodically sending a pretty large amount of data directly to client machines. These client machines are in various secondary sites, with correctly configured boundaries. It does *not* seem to be related to package pushes. Rather, it seems to crop up shortly after the monthly Microsoft updates are distributed to each of the secondary servers (but before these updates are even deployed/advertised to clients.)
 
In today's case, a RiverBed network report is showing that the SCCM server sent about 20MB of data to a number of individual clients. I checked out the client logs on some affected machines, and they are aware of the local secondary and its available distribution packages. So I can't understand why (or what) the SCCM primary is sending to these clients. This secondary site also has a working WSUS installation, along with SUP role.
 
All I can think of is that the clients are trying to determine which Microsoft updates are applicable to them, by querying each one. But wouldn't that information/data get sent to the local MP, and from there to the primary server? Any ideas why the SCCM primary is sending data directly to client machines? Or better yet, where to look to find out what exactly it's sending, and how to stop it?
 
Thanks for any assistance.

Hard to tell exactly what's going on here but a few (hopefully helpful and) relevant facts:
- Site servers *never *send anything to clients. Everything client-centric on ConfigMgr is pull (except client push, remote control, and WoL).
- Software Update information comes from the SUP and should come from the SUPs in the secondary site if the SUP is marked as active and the client is in the site's boundaries. Check wuahandler.log on a client to verify
- Update catalog transfer is very small on an on-going basis. The inital catalog transfer is typically up to 10MB (always via BITS) but after that it's in the 100's of KB.

check the contenttransfermanager.log on the clients to see what they are pulling.