Unexpected shutdown of all workstations
Is there some place else to look for commands send to endpoints from the K1000?
If you have any scripts that use the shutdown.exe command, open those scripts and click the "Show All History" link in the upper right. That should show you if they were run at all, even if they don't show on the Run Now Status page.
You may also want to double check your patching schedules, to see if any coincide with the shutdown event. That would be a bit unusual, though, since patches typically only do a restart (if configured to), not a shutdown.