Just a few random thoughts here to hopefully open some more doors here...
Did you happen to have a subsequent kernel update to the host operating system? Anything in the /var/log directories of relevance?
Does your machine have any scheduled tasks running at a specific time?
I think you said your server 2008 system is a terminal server. Is there any chance your server 2008 system that reboots is performing (and failing) some sort of authentication at the time? Perhaps check your domain controller logs for unsuccessful authentications right around the time of the reboots. Can you run wireshark (or something like that) against the network interface (with proper permission from whoever grants it) to get some idea of what your bsod server 2008 system is doing some time before it's reboot (is it attempting to talk to "anyone" (any server))?
Is it only that one specific system that reboots?
Have you heard of Zenoss (it's free, yet they have a paid/enterprise version). Very powerful, not good for your immediate issue, but good for overall systemic health if properly set up.
Just an idea to hopefully garner more clues -- consider running process explorer on the victim kvm guest operating system (your System 2008).
technet.microsoft.com/en-us/sysi ... 96653.aspx
Process Explorer I believe was originally created by sysinternals, and Microsoft bought them out (because they were too good). Anyway, run process explorer, make notes of what you see soon after the reboot, and then later at different times of the day.
Is there a specific time this occurs? Is the only change a service pack? (I think I read that a service pack was installed?) Is there anything from the event logs during/after the time of the reboot?
After the server 2008 reboot, go to (on the host system) /var/log/ and 'ls -altr' to see what was written to last, or a find command that is set to see the last files written to in about 30 minutes?
Hopefully the above link may help?