The bland logs are themselves a data point. If the journal just stops mid-line with nothing unusual before it, that points at a hard hang or a power cut rather than something userspace did, because a kernel oops normally leaves a trace behind. There’s also a catch-22 in the SD theory: a card that’s failing can’t reliably write the log that would prove it’s failing.

Two things worth doing before the card swap, both cheap. Check vcgencmd get_throttled: bit 16 stays set if undervoltage happened at any point since boot, so you get an answer on power-versus-card without having to catch the crash live. And switch on the hardware watchdog, bcm2835_wdt plus RuntimeWatchdogSec in systemd, so the Pi resets itself instead of waiting for someone to pull the plug. That doesn’t fix the cause, but it stops every crash from becoming an outage that lasts until you’re back home.

In my experience random reboot problems are usually related to the sd card. standard logging setups kill the card faster than you’d think. dd the existing install or rebuild the server.

time to test your disaster recovery strategy!