Win Key + R
Type: "Eventvwr.exe"
On the menu on the top left, navigate to Windows Logs / System. Right click it and select "Filter Current Log". In the pop-up, enable the "Information" tick box only. Then within the list of log entries, scroll to one or more periods of shutdown.
There will be a collection of lines for a given shutdown, as each process and service is terminated, but the first one of that batch should be the initiated shutdown by the user, perhaps labelled as source "USER32" or similar.
Here are my most recent (personal info in [Square Brackets] ):
The process Explorer.EXE has initiated the power off of computer [Computer Name] on behalf of user [Computer Name\Username] for the following reason: Other (Unplanned)
Reason Code: 0x0
Shutdown Type: power off
This then initiates the shutdown, with the next log being:
The process C:\Windows\system32\winlogon.exe ([Computer Name]) has initiated the power off of computer [Computer Name] on behalf of user [Computer Name\Username] for the following reason: No title for this reason could be found
Reason Code: 0x500ff
Shutdown Type: power off
The logs that follow are a mix of services being stopped. The last two are:
The kernel power manager has initiated a shutdown transition.
and
The operating system is shutting down at system time [etc].
What you need to look for is if the computer was put into Sleep, Hibernate or Shutdown, and perhaps look at the first couple of logs as it starts up.
For what it's worth, my first two shutdown logs are coded as 1074, with the last two being 109 and 13, and the startup code is 12. Hoping you see something different to help with the investigation.