I read this more lately, why would you prefer to leave secure boot to ON? It's not a security option, it's just to enable msft and the oem facturere to lock the device to it's original factory OS.
secure boot is not a Microsoft feature. Other than the purposes (enable MS and OEM verification) you mentioned, it can also prevent unauthorized/tampered boot loader from loading. So it is indeed a security feature as well. Plus, I don't want to change the UEFI options once I optimize it, even if temporarily. Anyway, I tried the wim splitting method - it indeed works.
I'll stay with 16299.15 ISOs since I think is the important one. By the way and sorry for the little offtopic, Merry Christmas!!!