Windows Server 2003: start program on event in event viewer

Open event viewer. Expand windows logs. Click system, then either find or filter for event ID 1074. And you will see all your shut down logs.

Event ID 540 for Logon Type 3 is a successfull network logon. Do you have IIS installed on the server running a publicly accessible web site? If so, that's the most likely source of the logons.