rebooted by root

[dcol]

Noticed in the logs this critical error 'rebooted by root'
Happening at least once a day. What does this mean, and how do I research it further?
I included other events near the same time from the log.

[Fright]

someone #reboot via ssh?
any clue in audit log around this time?

[dcol]

Audit logs shows nothing at that time. General logs are cleared after reboot.
No one but me has access and no one rebooted manually. I am updating to latest version today.