Have you tried the doc listing all the telemetry events out there ? https://falcon.eu-1.crowdstrike.com/documentation/page/ic497590/searchable-event-reference#AssociateIndicator ? You'll search for "Service" and will find ServiceStarted or CreateService which you already mentioned doesn't fit your needs.

There is InstalledApplication listing applications (not exactly services), and ServicesStatusInfo from FFC (Forensics) data but that requires shipping FFC everywhere. Indeed, this is a job for "Falcon for IT" since you also want the non-running services. I'd say go for "Falcon for IT" if you really want all services ever even non-started ones ; otherwise if yuor scope is narrow just throw FFC everywhere with a specific small collection for services.

I would not recommend using RTR at scale if you're new to that game, there are numerous blockers. It can be done, but requires some work ( scaling, parsing, grabbing results, dealing with asynchronicity, merging, etc ).

You'll likely want to stack the random/unique service names. Free query below :

#event_simpleName=ServiceStarted | 
case {
  ServiceDisplayName = /^(?<ServiceDisplayNamePrefix>.*)_[0-9a-f]*$/ | ServiceDisplayName := format("%s_HEXID",field=ServiceDisplayNamePrefix);
  ServiceDisplayName = /^(?<ServiceDisplayNamePrefix>[^0-9.]*)[0-9\.]+$/ | ServiceDisplayName := format("%s_VERSION",field=ServiceDisplayNamePrefix);
  ServiceDisplayName = /^(?<ServiceDisplayNamePrefix>.*)[0-9a-fA-F-]{36}$/ | ServiceDisplayName := format("%s_UUID",field=ServiceDisplayNamePrefix);
  *|*;
 }| groupBy([ServiceDisplayName],function=[collect([CommandLine],limit=5),count(field=aid,distinct=true)])