When does a SEPM create delta's from a full.zip ? Does it start the delta creation when a client requests updates(incrementals) or does the SEPM create
deltas from the full.zip definition inside the content folder? Why do I see some folders only having full.zip and no deltas (32bit and 64bit defs) while others have both?

I am trying to work out if my SEPM cannot handle the load(27000 clients  = 4 SEPM's) to create the deltas and is sending full.zip files to clients whom are in need of incrementals only (perhaps 1-2 days old).

AFAIK, deltas are only created when clients that have defs within the SEPM's retained defs requests new ones.

In other words, I think the process works as below:

1. SEPM Updates and has new defs available
2. Client checks in requests new defs
3. SEPM checks if the client (from it's uploaded logs) has defs within its own retention period.  If so, it creates a delta file, and provides the client the link to download the delta
4. Client updates

At step 3, if the SEPM is unable to create a delta, it will give the client the link to the full defs

check this

When will a client download a full definition set from a Symantec Endpoint Protection Manager or Group Update Provider?

Is there anyway to restrict the client from getting a full update and receive only delta's until it comes up to date?

Is there anyway to view when a SEPM cant create a delta and HAS to provide a full update?

SO..it means deltas only get created when a client requesting an update requires the delta...

it depends on how may content revisions are stored at the sepm, if sepm can create delta, then it will or else it will send out the full.zip to client. how many content revisions are stored at SEPM? whats the current def at the client?

if you are storing 30 revisions in SEPM, then SEPM has 10 days of defs and can send out delta, 

if the client is older than 10 days, then its full,zip

It's worth clarifying that deltas contain the difference between the client's defs and the latest.  They are not incremental.  You won't get a client being assigned delta after delta to bring it up to date, it'll just be the one.

If the defs stored on the SEPM don't go far back enough to cover those on the client, then the SEPM has no way of calculating the differences, therefore it must tell the client to perform a full update.

Deltas are created on the fly

we are storing 85 revisions.