If a qube is trying to auto-update, run the following in the dom0 terminal to disable:
qvm-service -d <qube-name> qubes-update-check
This should be disabled by default, which one can verify with (should report as “off”):
qvm-service <qube-name> qubes-update-check
I also take the additional step of using .onion repos whenever possible so that attempted updates over clearnet will not be successful. I would also see these show up in my pihole filter, where all .onions are blocked, but I haven’t seen anything like this so I wonder if there was a recent regression that resulted in this behavior in new installs?