The KB article says that routed ICMP requests will be responded to from the same VMKernel that received them. There isn't anything by default in ESXi 6's Security profile to block ICMP.
Since imsuchageek has said that blocking ICMP on the routers between the subnets isn't an option due to...
If you have tech support that can't identify a host a VM is running on you either haven't given them the right permissions, or the right training. Or failing those two, you don't have the right tech support.
Id suggest finding out the exact reason why WSUS is an issue? I've got it running between 5 sites, one of which is heavily fire-walled, and 3 of the sites or on slow links, and it just works.
As cyclone says, it's free.
In case it helps, this is VMware's update process guide for vSphere 6 : http://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&externalId=2109760
Because.....
Did adding the DNS forwarders fix the issue for you?
If not, you mention you have multiple sites, are they all connecting through the same gateway to the internet, or do they have their own gateways?
Have you checked for any Group Policy's that are pushing WSUS settings out? I'd suggest getting the Windows update issue fixed before worrying about a random DNS glitch...
I had a similar issue at the start of last year (Literally New Years Day 2014) with E1000 and ESXi 5.5. My fix was to go with VMXNET3s. Not quite the same as the issue you are experiencing, but it's worth considering that VMXNETs are designed for VMs whereas the E1000 are emulating legacy...
Have you tried limiting the age of records kept by vCenter from vCenter? Administration > vCenter Server Settings > Database Retention Policy, and turn on the retention limits
You can script vSwitch creation using PowerCLI - I do it to automate the set up of new ESXi hosts - With the more recent versions of PowerCLI you can setup DVS too