Sierra upgrade weirdness

I've started testing the Sierra in-place upgrade on a few Macs. I have a policy built to cache the installer (that was downloaded from the Mac App Store and then processed via Casper Admin) onto selected Macs and then another self service policy to install the cached package. Users have run the self service policy and everything goes great. Takes about 20-25 minutes to complete. The weirdness comes in anywhere from a couple hours later to the next day.... (I have a Restricted Software record set to notify me if the "macOS Sierra installer" is run. Users get a pop-up and i get an email. This was put in place to prevent users from jumping the gun and trying to upgrade their Macs from the Mac App Store before we're ready.)
... So at some point after the computer has been successfully upgraded, out of the blue I get an email from the server telling me that the macOS Sierra installer is being run and the user gets the pop-up notification as well... but they didn't do anything to trigger it.
Could this be a matter of the Restricted Software taking a very long time to be recognized as being run from Self Service before alerting me or is there some background process that is reaching into the /OSX Install Data folder that was left behind from the upgrade and launching it?