Suggestions / possibility of a clean, updated Win7 fresh install

I made a flash drive installer with RTM Win7 in 2009, have been using that ever since. As you might guess, this has become untenable in the last year. (Lately most of my installs have been 10, so hadn't realized how bad it was)

Much grumbling about Microsoft not releasing a SP2 for 7, but was surprised and happy to see the "Convenience Rollup" https://support.microsoft.com/en-us/kb/3125574. I tried that out a few weeks back, it still took over 48 hours to apply all updates to a new system.

I figured out that I really needed to get the slipstream method going, and worked thru the process at The Last Windows 7 ISO You?ll Ever Need: How to Slipstream the Convenience Rollup That seemed to work, I now have a new installer that nominally updates the new system to April 2016.

Question 1:
To double-check: after a fresh install with this slipstream media, I look in "System" and it says "Service Pack 1". If I look in "Windows Updates" - "Installed Updates", I see the servicing stack update, and the convenience rollup. (KB 3020369 & 3125574). This is what I should see, right?

But the devil is in the details. This system has IE8 installed. Obviously a big security hole. While I tell my people not to use IE, some of them like it, and we also have some applications that claim to require IE. So I installed the latest IE11. After installing that, it wanted to install another ~7 critical security updates. Reboot and now it wants another ~20 updates. .Net critical updates, etc. Another reboot and it wants more critical updates. (PS - I haven't replicated this. I did also install an Intel USB 3 driver injection utility at about the same time. It possibly was the cause of the .Net updates)

Question 2:
Is there a reasonable list of updates to an April 2016 system that would result in a stable, secure, general purpose PC?

Continuing on: Ok, three months have passed since the convenience rollup package, more monthly Windows updates. Great, Microsoft is now using a cumulative "update rollup" system, so I only need to get the July patch. Easy! But I've just loaded a new system, I try to apply the 3172605 July rollup. It sits at "Searching for updates on this computer" for several hours. (this is downloading the .msu file on another computer and trying to run that). If I run Windows Updates to check, it also "Checking for updates" for hours with no result.

(I'm hitting Post at this point, will add another comment with more info)

Ok, made it thru moderation....

I was browsing other posts here, this one from Callender allowed the 3172605 July rollup to apply:
svchost.exe High CPU usage 98% of at least one CPU. - killing Windows update in services.msc

But after a reboot, now it wants to install 38 critical and 37 important updates. I just don't understand this.

This particular PC is a Asus Zenbook UX31A that had Win8 installed. User wanted Win 7, which I finally got to install by changing BIOS USB support to "AUTO". After the plain jane Win7 Pro 64bit install, I did have to add about eight drivers for Wifi, USB3, USB-ethernet, Graphics, etc. Could those drivers cause these very old updates to now show up as required? Oh, it is even asking for Service Pack 1 for x64 again. Grrrr.