Run the error and print filters in monitor as a minimum.Set log to file if you want to leave it running to capture both sides of an event.
Also view system status/ alarms for a possible reason, such as brownout or blackout.
Sometimes weird trunk voltages can force reboots, so consider running trunk filters in monitor as a second step.
If you check the 'Using system monitor' manual it details what filters to run for each particular problem.
Tier III have also recommended running default filters. I have used this method to capture an event I was missing by running the filters i thought i should.
You can also set time stamps from handsets using a short code or button. This time stamp is reflected in bright colouring in monitor.
Change your monitor readout to show the time instead of milliseconds the system has been powered on for if using this method.
Most common reason though, physical connection issues or power supply problems.
Physically inspect the power cable. Replace it in fact. 2 minute job.
Check the socket with a multimeter or consider a different circuit.
Second common reason, some doofus, dingus or wingus plugged a PC in to a socket patched to the IP Office.
Make sure the IP office monitor feed isn't available on the internet and is only on necessary computers. Also check those computers aren't compromised.
You can reboot all IP and Sip phones from monitor. That would seem like a reboot and leave no alarms in system status.
Depending on the URI configuration the ICR can be completely ignored.
If your URI is configured to use internal data then the IP Office will look into the user's SIP tab and if you have *'s it will look into ICR.
A madman with a taste for speed.