LiveUpdate policy question

I need to understand how a SEP client make the decision of connecting to a external LiveUpdate server. I have SEP clients that are bypassing their assign GUP and the default management server and going straight to a external LiveUpdate server, while other SEP clients in the same physical location and same SEP groups are receiving their content from GUP. Pretty much looking for the logic behind the selection of the content source that a SEP client is making and not troubleshooting steps.