I’d suggest taking a ‘screenshot’ of all the router stats when it isn’t happening to start with ... to have baseline as such. Then have the suspect switched on at an agreed time and then watch the stats.
Is an overall wider picture of the event not possible by examining the DSLAM logs ?
Does the Now Broadband router have this ability? It seems very limited in terms of it's logs for example here is alll I can see.
Sep 22 12:55:41 syslog: Lease renewed 3600 ip *.*.*.*
Sep 22 12:55:42 syslog: VCOP agent started.
Sep 22 13:30:46 syslog: Lease renewed 3600 ip *.*.*.*
Sep 22 13:30:46 syslog: Send out NTP request to ntp1.isp.sky.com
Sep 22 13:30:46 syslog: Received NTP Sync Reply from ntp1.isp.sky.com
Sep 22 13:30:46 syslog: System time is up to date
Sep 22 13:30:45 syslog: VCOP agent started.