Well, of course we are guessing too. But I'll make a start.

Does this occur after any specific action on your part, like running ......?
Do your event logs show any events around that time that are not always associated with shutdown and startup?
Do your web logs show any activity at that time that seems to be common?
When the "bugcheck" runs does it create any logs or display any error code? If so, what do they say?