@MaxBishop
What you need to do first, before becoming too concerned, is to look in the Suricata alerts and see what internal machine or machines are initiating that traffic. If your firewall is configured as it should be, then nothing can just "come in" from the WAN unless an internal host opened the initial connection. That's how stateful inspection firewalls operate.
If you have Suricata on the WAN and are using NAT, then finding the internal host is going to be hard. That's why, when using NAT, you should instead run Suricata on the LAN. That way internal hosts will show in alerts with their actual IP address instead of being "NAT'd" to the WAN IP.
Odds are you are correct and these are simply Windows clients downloading security updates. That particular set of Emerging Threats rules is not really to useful on most networks because the rules will false positive frequently. They really are more appropriate in an enterprise network when you run an internal update server such as someting like Microsoft's WSUS. In that case, if you ever had clients downloading an EXE or DLL file from the Internet, it could be potentially bad (but even then, not always bad).
