why would anyone need to be up so late except for in the most urgent of issues is insane to me.
That's the problem you have. Defining "urgent". Logging activity gives you a sense of the quantity of work carried out after hours, but not the quality.
An example we might have: our guys are working on a multi-million dollar deal and the client e-mails them from New York in the late afternoon. The client doesn't care that it is midnight where we are in the UK, he expects an immediate answer. That one e-mail is more important than the thousand e-mails we received during the day. In financial terms, it could represent 20% of our revenue. So 0.0001% of IT activity represent 20% of revenue.
You can't analyse that. You can only trust that if your guys say they need 24/7/365 access, they do.
And that is why I'm trying quantify who and when people are working while not in the office.
Because as @Breffni-Potter said (and is true) the system will have to come down at some point, it might as well be planned, rather than unplanned.