Windows server EC2 is constantly shutting down

When the instance is in the "stopped" state, what does the field "State transition message" show for the instance in the EC2 management console?

Most often, it will say Client.UserInitiatedShutdown, meaning that the instance was stopped by calling the StopInstances EC2 API, which would show in CloudTrail logs for the region. You mentioned you didn't find any of those events. The next most common reason code would be Client.InstanceInitiatedShutdown, which indicates that the shutdown was requested by the operating system on your instance. The System event log on a Windows server would record an event when a shutdown is initiated, and if the server simply crashes, the System log would record an event on start-up that says the previous system shutdown was unexpected.

If the state transition message says Server.SpotInstanceShutdown, it means that the server was running on spot capacity which AWS reclaimed for on-demand use. You shouldn't use EC2 spot capacity to run workloads that you expect to remain available uninterrupted.

All the instance stop reasons are listed on this documentation page, with general descriptions of what each of them means: https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_StateReason.html