I've been encountering this same problem for weeks now on user workstations, some shutting down on a regular basis and others at random. I contacted Kaspersky Support and they provided me with this information as well as a patch, we're running Kaspersky Endpoint Security 10 for Windows 10.2.5.3201.
Current WOL design is as follows:
1. If PC was switched ON by WOL > the task completes machine will be always switched OFF.
2. In case if option "shut down machine when task is completed" is selected machine will always be switched off.
3. In case if PC has been running for some time, and when scheduled task completes (and WOL should wake up the host), in this case PC will not be switched off. In other words, running host will not be switched off, even despite if WOL is selected in a task option.
4, In case if machine was switched on by WOL, and not a single is logged in, machine will be switched off. Currently we have a faulty behavior, for example in case if machine has been running, and has not been switched by WOL, but this task according to schedule is running, machine will be wrongfully switched off.
This behavior will be fixed in the patch. Please apply this patch only if Network Agent version is 10.3.407.
In my environment the problem was always the most widespread after a 3 day weekend - the reason being as indicated in #4 above as I force PCs to reboot over the weekend, if no user logs in on Monday, and the Virus scan with WOL runs Monday night, then the PC was being shutdown, leading to a slow start up Tuesday morning. OR as is the case for the users whose PCs were being shutoff nearly every week - if they "log out" when they're done on Monday, so that no user is logged in, then the PC would be shutdown by Tuesday morning.
Turning off WOL prevents these virus scans from running on some PCs however so I am glad they provided me with the patch.