Zscaler seems to be blocking iOS updates. Is there a URL besides .apple.com I need to add?
FYI: I had to disable scanning for the following URL: updates.cdn-apple.com.
Matt - glad to see you figured it out. Zscaler has a page detailing a bunch of common applications that would have this same experience if SSL Inspection is enabled for specific host names. You can find that here:
Certificate Pinning and SSL Inspection | Zscaler