Well, I didn't figure out how to turn updates back on through a provisioning action. But I found a way to get them turned back on before capturing the image.
As I was playing with the base image, generalizing a snapshot, I noticed a quick flash that updates were turned off. I normally shut the vm down with the shutdown switch in sysprep, so I decided to keep it running after sysprep finished generalizing. I went in and turned Windows updates back on before shutting down the vm to capture.
That is working for me now. Updates are now turned on after image deployment. Still would be nice to know why this is happening in the first place, but on to the next battle.