I am a little confused by your question as
/var/log/auth.log already logs denied service stop/start by users without permission.
If you want to only see the service related events and only FAILED attempts, you can run as
$sudo cat /var/log/auth.log | grep service | grep FAILED
Here is a sample output of a basicuser I just created without sudo, that then tried to run
service alsa-state restart . The output tells you all that you may need to know, and I put the important parts (date, session, FAILED, service name, username) in bold
foot@BOOT:~# cat /var/log/auth.log | grep service | grep FAILED
Mar 1 21:13:24 BOOT polkitd(authority=local): Operator of
unix-session:6 FAILED to authenticate to gain authorization for
action org.freedesktop.systemd1.manage-units for
system-bus-name::1.255 [systemctl start alsa-state.service]
(owned by unix-user:basicuser)
The auth.log file will tell you all that you need to know regarding authorization failures including services and login attempts.