There have been a number of client-side patches released for SCCM over the last few years and I've never truely had successful deployments of them via Client Push. This is a rather annoying issue because it means that I have multiple client versions which each have their own quirks about them. The patch would fail with an MSI code 1635 which would also cause the client to install/update as well.
I found this blog post on technet that pointed me in the right direction:
Basically, i added Domain Computers to the share permissions of the SMSCLIENT share on my primary site server. After that, I was able to deploy the client with the patches and have them install properly!