Hello,
Service restarts are done by the dataskq.
DirectAdmin adds commands to the /usr/local/directadmin/data/task.queue and the dataskq is run by cron as root.
Note that directadmin itself can get root if it needs to with the "effective" uid system instead of the true uid system, but 99% of the time it's running as nobody to increase security.
John