Figured it out - If your clients are only powered on during business hours, create a task that starts at 10:00 a.m. local time with 6 hours of randomization. This will spread out all your clients between 10:00 a.m. and 4 p.m. (local time) for VSE DAT updates. Why wait until 10:00 a.m.? Because if a machine starts up after 10:00 a.m., it will wait until the next 'trigger' (which could be the next day or repetition of the task). Most people arrive at work by 9:30 a.m. local time, so waiting until 10:00 a.m. helps assure the majority of the clients will get that days task, and pick a random time between 10:00 a.m. and 4:00 p.m. to minimize bandwidth usage throughout the day.
We had an issue with bandwidth due to rollout of VSE 8.7 requiring full DAT update (~60 mb). Killed the branch WAN connections when 'Update at Boot' task was enabled.
Randomization is time BEHIND your trigger. It does not spread out before. i.e. A 10:00 a.m. trigger time with 6 hours of randomization does not create a window from 7:00 a.m. to 1:00 p.m. (3 hours before + 3 hours after) or 4 a.m. to 4 p.m (6 hours before + 6 hours after). It creates a window from 10:00 a.m. to 4 p.m. (6 hours post trigger time).