[Google Pixel 3a Questions & Answers] Cynicalsomething:
Resolved

I seem to have figured out why this is happening. I used logcat to pull the log while SystemUpdate was checking for updates.

Here is what I found:

10-07 17:27:51.314 18025 1536 I SystemUpdate: [Execution,UpdateEngineDelegate] verifyPayloadMetadata()

10-07 17:27:51.319 1156 1156 I update_engine: [INFO:binder_service_android.cc(179)] Received a request of verifying payload metadata in /data/ota_package/payload_metadata.bin.

10-07 17:27:51.327 1156 1156 I update_engine: [INFO:payload_verifier.cc(102)] signature blob size = 267

10-07 17:27:51.332 1156 1156 I update_engine: [INFO:payload_verifier.cc(118)] Truncating the signature to its unpadded size: 256.

10-07 17:27:51.334 1156 1156 I update_engine: [INFO:payload_verifier.cc(129)] Verified correct signature 1 out of 1 signatures.

10-07 17:27:51.336 1156 1156 I update_engine: [INFO:payload_metadata.cc(224)] Metadata hash signature matches value in Omaha response.

10-07 17:27:51.372 1156 1156 I update_engine: [INFO:dynamic_partition_control_android.cc(319)] Loaded metadata from slot A in /dev/block/bootdevice/by-name/system_a

10-07 17:27:51.374 1156 1156 I update_engine: [INFO:dynamic_partition_control_android.cc(957)] vendor_a is mapped on device mapper: /dev/block/dm-1

10-07 17:27:55.082 1156 1156 I update_engine: [INFO:dynamic_partition_control_android.cc(319)] Loaded metadata from slot A in /dev/block/bootdevice/by-name/system_a

10-07 17:27:55.084 1156 1156 I update_engine: [INFO:dynamic_partition_control_android.cc(938)] boot_a is not in super partition metadata.

10-07 17:27:55.086 1156 1156 I update_engine: [INFO:dynamic_partition_control_android.cc(319)] Loaded metadata from slot A in /dev/block/bootdevice/by-name/system_a

10-07 17:27:55.092 1156 1156 E update_engine: [ERROR:delta_performer.cc(1158)] The hash of the source data on disk for this operation doesn't match the expected value. This could mean that the delta update payload was targeted for another version, or that the source partition was modified after it was installed, for example, by mounting a filesystem.

10-07 17:27:55.094 1156 1156 E update_engine: [ERROR:delta_performer.cc(1163)] Expected: sha256|hex = A9CA8642B1E38A6D8707C31B9C146CB04CFE390A79853CF8AB0FFA9091CDC6CC

10-07 17:27:55.096 1156 1156 E update_engine: [ERROR:delta_performer.cc(1166)] Calculated: sha256|hex = 5BE55D2089653B1A9A244BDDF60582ACAFC0444B7F62A8546E0D030337C00331

10-07 17:27:55.097 1156 1156 E update_engine: [ERROR:delta_performer.cc(1177)] Operation source (offset:size) in blocks: 0:1,8172:1

10-07 17:27:55.117 18025 1536 E SystemUpdate: [Execution,PreDownloadValidateAction] UpdateEngine.verifyPayloadMetadata() failed.

10-07 17:27:55.686 18025 1536 E SystemUpdate: [Execution,PreDownloadValidateAction] Failed to download.

10-07 17:27:55.686 18025 1536 E SystemUpdate: awhr: Unexpected status code: 403.

10-07 17:27:55.686 18025 1536 E SystemUpdate:	at awhv.run(:com.google.android.gms@203615046@20.36.15 (150400-333172415):7)

10-07 17:27:55.686 18025 1536 E SystemUpdate:	at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:462)

10-07 17:27:55.686 18025 1536 E SystemUpdate:	at java.util.concurrent.FutureTask.run(FutureTask.java:266)

10-07 17:27:55.686 18025 1536 E SystemUpdate:	at qzo.b(:com.google.android.gms@203615046@20.36.15 (150400-333172415):12)

10-07 17:27:55.686 18025 1536 E SystemUpdate:	at qzo.run(:com.google.android.gms@203615046@20.36.15 (150400-333172415):7)

10-07 17:27:55.686 18025 1536 E SystemUpdate:	at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1167)

10-07 17:27:55.686 18025 1536 E SystemUpdate:	at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:641)

10-07 17:27:55.686 18025 1536 E SystemUpdate:	at rfo.run(:com.google.android.gms@203615046@20.36.15 (150400-333172415):0)

10-07 17:27:55.686 18025 1536 E SystemUpdate:	at java.lang.Thread.run(Thread.java:923)

10-07 17:27:55.686 18025 1536 E SystemUpdate: [Execution,PreDownloadValidateAction] Failed to validate package, with resolution=REJECT.

So it looks like it was seeing a difference in the expected boot image hash vs my magisk patched boot image. I used magisk to restore images and re-ran the SystemUpdate. At that point it indicated that there was an OTA to install. I thought in the past it would at least indicate that there was an OTA to download, at which point I could go through the magisk restore images process. Oh well.

TL;DR: I needed to restore the boot image in magisk prior to checking for updates in order for the OTA to show up.