I think that Norton was wondering if the computer does the same thing under different circumstances, like when the computer was shut completely down and then restarted.
There are any number of tasks that can be triggered by different conditions like, "At log on" or "At sign-in" or "On Wake.
These can be triggered by a Scheduled Task, something in the Startup Folder, Checking the box in Folder Options, View tab to "Restore previous folder windows at logon",
AND
Even in some instance, built-in or installed software like "Smart Start".
Does it only happen with the USB drive connected?
AND
IF so, does it happen as well, with the USB drive connected from a full shut down and then a restart?
YOu may want to use the native powercfg utility to generate a general report or perhaps a sleepstudy report. Google it and see if that provides any insight.