It looks like System Event ID 6005 and 6006 are the typically suggested events, but more directly correlate to the Event Viewer directly:
How to view Startup and Shutdown history in Windows - The Windows Bulletin
Just one article I found, but three others had the same event IDs referenced.