Endpoint Protection and Null sessions

I am seeing nullsessions being denided on some of my workstations.  Not int he thousands but occasionals.  I have narrowed it down to either SCCM or Symantec.  I know in SCCM you can set it to "share" updays with other machines on the local subnet to reduce over router traffic back to the server.  Does Symantec to anything like this?  If so would it use a null session to do it and is that a configurable setting?