root entries in last command
These entries are fully normal.

The shutdown needs root priviledges to run, most notably to be able to kill all processes.
This doesn't mean that the root user logged on your system, and is totally independant of the fact that the root user is activated.