Strange auth.log entries

Hello ,

I am trying to detect why I am getting this entries on auth.log.
the root login is disable in ssh_config

Nov 7 12:10:01 host CRON[28341]: pam_unix(cron:session): session closed for user root
Nov 7 12:11:01 host CRON[28506]: pam_unix(cron:session): session opened for user root by (uid=0)
Nov 7 12:11:02 host CRON[28506]: pam_unix(cron:session): session closed for user root
Nov 7 12:12:01 host CRON[28637]: pam_unix(cron:session): session opened for user root by (uid=0)
Nov 7 12:12:01 host CRON[28637]: pam_unix(cron:session): session closed for user root
Nov 7 12:13:01 host CRON[28678]: pam_unix(cron:session): session opened for user root by (uid=0)
Nov 7 12:13:01 host CRON[28678]: pam_unix(cron:session): session closed for user root


ls /etc/cron.d/
csf-cron csf_update directadmin_cron lfd-cron

crontab -l
no crontab for root

Where should I check this activity ?

It comes from /usr/local/directadmin/dataskq that is using 100% CPU

/etc/cron.d/directadmin_cron
* * * * * root /usr/local/directadmin/dataskq
2 0-23/6 * * * root echo 'action=vacation&value=all' >> /usr/local/directadmin/data/task.queue;
#5 5 * * 0 root /sbin/quotaoff -a; /sbin/quotacheck -augm; /sbin/quotaon -a;
10 0 * * * root echo 'action=tally&value=all' >> /usr/local/directadmin/data/task.queue
20 4 1 * * root echo 'action=reset&value=all' >> /usr/local/directadmin/data/task.queue
0 4 * * * root echo 'action=check&value=license' >> /usr/local/directadmin/data/task.queue

Any tips to avoid 100% CPU usage ?

Thanks