This is totally untested, and I know nothing about winrs. But I believe it is only a matter of escaping the redirection the proper number of times. Assuming n is the number of escapes, then the number of carets required is 2 to the nth power, minus 1 ((2^n)-1).
If you want the output to be redirected to a file on the remote machine, then the redirection must be delayed until WINRS launches the remote process, so twice, once for START, and once for WINRS
start /wait winrs -r:NODENAME -u:USERNAME -p:PASSWORD taskkill /FI \"USERNAME eq USER" /f ^^^>output.txt
The only other variant I can think of is to explicitly launch a cmd.exe process to handle the redirection, again with escaped redirection. In this case I think you need three escapes:
start /wait winrs -r:NODENAME -u:USERNAME -p:PASSWORD cmd /c taskkill /FI \"USERNAME eq USER" /f ^^^^^^^>output.txt
If you want the output redirected to a file on the local machine, then you need to redirect the output of WINRS (assuming WINRS displays the output of the remotely executing process). So just one escape should be required.
start /wait winrs -r:NODENAME -u:USERNAME -p:PASSWORD taskkill /FI \"USERNAME eq USER" /f ^>output.txt
I'm surprised you need to launch WINRS via START. I should have thought you could execute the command directly, since you plan on waiting for it to finish anyway. If launched directly, and you want the output collected in a local file, then I think you don't need any escape.
winrs -r:NODENAME -u:USERNAME -p:PASSWORD taskkill /FI \"USERNAME eq USER" /f >output.txt
I'd appreciate a comment as to which, if any, of my suggestions work.