All the checks in the first link above were done.
The first event log entry for the rogue power up was for the APC UPS: "PowerEvent handled successfully by the service." The security auditing for event 4672 is the same whether the rogue presses the button or I did.
However, the second system entry for the rogue power up is
TCP/IP NetBIOS Helper param2 stop param3 0x40030011 param4 Operating System: Network Connectivity (Planned) param5 None
For the human power up there's
param1 TCP/IP NetBIOS Helper param2 running
POWERCFG DEVICEDISABLEWAKE disables the device from waking the system from a sleep state, but what about from hibernation?
powercfg -lastwake provides no help.