Direct associations under Bundles/ZPM/Microsoft Corp.

I can't seem to find the answer to this anywhere so I am posting here in the hope that Shawn Pond can answer this. I oversee a large ZCM 11.2.4 installation with several administrators and as I check the bundles associations on Windows workstations, I constantly see direct associations to Microsoft patches that are located under Bundles>ZPM>Microsoft Corp.>[month/year]. My understanding of how ZCM patch administration works is that remediation bundles should be created by choosing patches to push and that these remediation bundles actually have install steps in them that call the downloaded patches as verification tasks. Therefore, I'm under the assumption that if you look at any of the actual patches under the path listed above, they should not show associations to any machines. I believe I have an administrator who is manually creating these direct associations, but no one will "fess up". Am I correct in my assumption or is there some other way that these direct machine associations could be automatically created without an administrator doing it?