Thankfully, I have a repo of all the little configs and scripts I have used.
You can do cat /proc/acpi/wakeup to see what is allowed to wake your machine.
Echoing the device ID into /proc/acpi/wakeup will toggle it between disabled and enabled.
So to disable XHCI wakeup, I had to do:
sudo echo XHC0 > /proc/acpi/wakeup
Now that will reset on every boot, so I wrote a systemd service to do it on startup, and instead of just disabling 'XCH0', I found another user online that had written a shell script to disable everything's ability to wake the machine.
This is the systemd unit to disable the ability for devices to wake the machine:
https://github.com/jknightdoeswork/dotfiles/blob/master/disa...
This is the shell script to install that systemd unit so it runs on every boot:
https://github.com/jknightdoeswork/dotfiles/blob/master/inst...
Note that with this installed, I'm pretty sure the only way to wake your machine is to press the power button. I prefer that but you might not. You may want to disable _just_ the XHCI devices, not _all_ of em. Up to you. Feel free to ask more questions.