sorry I did not respond. work has taken me other directions for a while.
I have also found that using shutdown.exe and rebooting the server from windows can have the same issue. seeing now that machines that have unexpected reboots do not have the 109 prior. The same machines when rebooting successfully have the 109 (The kernel power manager has initiated a shutdown transition.). All cases they have the 1074 e.g. (The process C:\Windows\system32\shutdown.EXE has initiated the restart...)
software should be all updated / current.