An update in the state "unknown" represents an update that has arrived on the WSUS server via synchronization, but does not yet have state data (Needed, Not Applicable, Installed) for one or more systems. Typically the "unknown" state for a recently synchronized update should completely disappear within the defined Detection Frequency for your environment.
A computer with updates in the "unknown" state that have been on the WSUS server for more than the Detection Frequency would indicate a computer that is not successfully reporting update status to the WSUS server. It may also be that the computer is not talking to the WSUS server at all (it might not even exist). For a computer with updates in "unknown" state, check the Last Contact Date and Last Reported Date in the appropriate WSUS Target Group, and if they represent times longer than the configured Detection Frequency, investigate the state of that computer.
It's normal to see a large number of unknown updates right after a major update synchronization with Microsoft such as on Patch Tuesday, or on the 4th Tuesday (today!) when Microsoft releases non-critical updates; but those "unknown" states should disappear after the configured Detection Frequency has elapsed. The default Detection Frequency is 22 hours.