As suggested by David, powercfg /waketimers
showed the following output
C:\WINDOWS\system32>powercfg /waketimers El temporizador establecido
por [SERVICE] \Device\HarddiskVolume4\Windows\System 32\svchost.exe
(SystemEventsBroker) expira a las 23:35:31 el 08/01/2017. Motivo:
Windows ejecutará la tarea programada 'NT TASK\Microsoft\Windows\Windo
wsUpdate\AUScheduledInstall' que solicitó la reactivación del equipo.
And a Google search pointed to this Microsoft answer:
https://answers.microsoft.com/en-us/windows/forum/windows8_1-performance/auscheduledinstall-disabled-but-re-eneables-itself/4332d01e-62cd-4b1e-8b21-a12e181e413d
Basically two solutions are provided:
Method 1:
Follow the steps to detect and disable the device using Command Prompt (admin):
Press Windows+X keys and select Run as administrator.
Type the following command and hit Enter:
Powercfg -devicequery wake_armed
You will get the name/names of the devices. To disable a specific device from waking the computer, run the following command:
Powercfg -devicedisablewake "devicename"
Note: Make sure that you replace the “devicename”placeholder with the name of the device that you want to disable.
If this issue still occurs after you disable one device, disable the devices in this list one by one until you determine which device is causing the issue. If you want to re-enable a device to wake the computer, run the following command:
Powercfg -deviceenablewake "devicename" command.
If the issue still persists, proceed further to the next method.
Method 2:
Let's disable the option in Group Policy to avoid wake up patters of the computer through scheduled tasks:
Press Windows+R keys and select "gpedit.msc".
Navigate to Computer Configuration -> Administrative Templates -> Windows Components -> Windows Update.
Modify the "Enabling Windows Update Power Management to automatically wake up the system to install scheduled updates" policy.
Select Disabled from the list of options in this interface.
If you are unable to use the Group Policy Editor method or it's not available in the current version of Windows, use may use the Registry Editor method:
Disclaimer: Please make sure that you backup the registry before proceeding with the steps mentioned below:
Press Windows+R keys and type "regedit". Hit Enter.
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
(you may need to create the WindowsUpdate and AU keys) and create a DWORD value named AUPowerManagement. Set this value to 0.
Or create and import the following file AUPowerManagementDisable.reg
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU]
"AUPowerManagement"=dword:00000000
Best Answer
Windows Event Logging tracks events like "system has resumed from sleep".
Check the Windows Dev Center example code on Querying for Event Information.
I've not used this first hand but you should be able to get there with Python too.