You can find out exactly what is causing this easy.
Telnet into the cisco router, and get into enable mode.
Once in, type "term mon" that will then allow the router to send console messages to you. I think you can also type "logging synchronous" and it will interrupt the sesion when you type.
Once you have done this, go the the bri interface. The command will be something like this.
conf t
int bri0
shut.
ctrl z
The shut command will close down the interface.
Then, type the following
debug isdn events
debug dialer (if you are using dialers and not legacy)
The next step is to capture the screen. In hyperterm go to "transfer" and "capture text"
Then the reverse of the shut
conf t
int bri0
no shut
What ever is bringing the line up will show on screen.
The best time to do this is after hours, there will be many devices I suspect that during working hours will bring the link up. You want to find the one in the evening that is doing it.
If you think you missed it, you can keep shutting and opening the bri as before.
Don't forget that debug is cpu intensive, when you have finished, type
no debug all
And debugging will finish. Also, do not forget to stop the capture.
You can play with this quite a bit. Have a look at
debug isdn q931.
That will debug layer 3
and
debug isdn q921
You can see the d channel then.
Hope this helps.