May be worth undoing the system restore & then rolling back to the earlier point at time of major update... ? Have a Windows Module Install on 19/2 rest pt, & automatic rest pt for 11/2
Resource monitor (discussed above) should give some insight into disk activity. I've seen situations with AV products that cloud storage products where by:
Cloud product syncs thousands of stub files to the device
AV scans stub files
Because cloud product thinks a process wants the full file (because AV has 'read' the stubfile) cloud product downloads the full file
AV scans full file
.... machine consequently bottlenecked for hours/days and happily filling up the disk.
Maybe a clean reinstall is the quickest path to resolution.
If you can wait until sometime next week, I could probably take a look via Microsoft Quick Assist.