Packagekit is fetching even disabled repositories. I've disabled one of my repositories (by setting enabled=0 in .repo file) and intentionally made a mistake in baseurl. After running "pkcon refresh", I've seen this in log:
15:53:54 PackageKit-DNF Skipping refresh of frantisekz-fedora-developer-portal: cannot update repo 'frantisekz-fedora-developer-portal': Cannot download repomd.xml: Cannot download repodata/repomd.xml: All mirrors were tried; Last error: Status code: 404 for https://copr-be.cloud.fedoraproject.org/results/frantisekzx/fedora-developer-portal/fedora-rawhide-x86_64/repodata/repomd.xml
Testing was done on F27, with PackageKit-1.1.7-1.fc27.x86_64.
I can confirm the same behavior, I clearly see disabled repos being accessed by packagekit in system journal. This might be one of the reasons why refreshing available updates in gnome-software has been taking so unbearably long lately.
As it turns out, this is expected behavior when there is enabled_metadata=1 in the repo file, which there is in our case.