Thank you for your question and reaching out.
The typical "service X is stopping" message that you would anticipate seeing during a planned shutdown is Event ID 7036.
Look for the event that causes those things to happen before those things happen.
The registry key PendingFileRenameOperations at the location HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSession Manager might be deleted as a workaround.
Please take note: Export the registry key before making the changes, and take caution when doing so as incorrect registry modifications could have major consequences.
--If the reply is helpful, please Upvote and Accept as answer--