As far as I can see, you are using the “old” log monitoring, not the event console. This creates services named “LOG foobar”. These services stay CRIT (or WARN), until the log messages received are acknowledged. I assume this leads to your situation, and it works as designed and there is no way around this.
Actually, with all that you have tried (downtimes, time periods, etc.) you are probably way over the top.
I recommend forwarding events to the event console and handle them there. That is way more efficient and gets you rid of the problem described here.