Common fault with W7 - Windows update takes up 100% of CPUs (or of one core on a multiple core cpu). Takes ages to run. Allegedly there is an update that fixes it but it didn't work for me.
Think only safe way is offline update such as WSUS but can't be bothered with the faff, so have just disabled updates and the Windows update service completely, installed GWX control panel and I'll take my chances thanks, Firefox + ublock-origin + NoScript get regular updates anyway.