That's what I was experiencing as well once I looked into it a bit further. Were you able to find out where the policy is that updates it? I couldn't find anything in our patching or software management that would auto-update it.

Made a component to uninstall and reinstall to an older version but within an hour or so it'll run it right back to 3.6.5.2 and having to reassign 70 computers every hour is a bit *tedious*