AlwaysOn Replicas set to manual but failing automatically
A reboot of a cluster node that has a resource group that's configured to automatically start forces the WSFC to start that resource on a surviving node, implementing HA feature of SQL Server AAG. This action also triggers SQL Server instance to promote an existing synchronous secondary replica to primary. I think you can avoid automatic failover by setting only one replica to be synchronous, however this will effectively make you lose data should you irreversibly lose the cluster node with the primary replica.