I'm guessing here but I would chroot to the uncompressed knoppix, set a root password and also remove sudoers file or edit it. Then remaster; the new burned CD should then not allow su, login as root or sudo unless you know the root password so make it long and difficult. I don't know if there is anything during startup where user knoppix needs su permissions so I think that should work.