First off, if your "restricted environment" doesn't allow you to make any changes, then you will most likely not be able to determine the root cause (at least not easily).
If you can make changes to audit settings, then this article should be exactly what you are looking for:
Basically, you will enable auditing on your service for successful "start" and "stop" events - or others if you like. These will then be logged to the security event log.
I was going to suggest installing EventSentry Light to then get a real-time alert when that happens, but your restricted environment probably won't allow for that. Hopefully you have a different monitoring solution in place which can do that. Disclaimer: I work for NETIKUS.NET.