First, the 'freebie look-see' has been completed.
To OP: there is a setting now in 3.6.x for 'path to php-cli' in moodle config that should contain the path to php-cli.
Site administration -> Server -> System paths
Path to PHP CLI should be set to: /usr/local/bin/php
That setting isn't auto-discovered by moodle.
Cron job ... which was op's conclusion (not running as it should) as to why badges weren't being awarded ... was perhaps configured correctly to begin with ... but I did make sure it was and tested.
For those with the latest version of cPanel, there is a terminal icon that will log one into the site via shell in a browser window. A which php did find/point to: /usr/local/bin/php.
Site uses EasyApache ... which uses .htaccess files to set version of php for a domain/site:
# php -- BEGIN cPanel-generated handler, do not edit
# Set the “ea-php72” package as the default “PHP” programming language.
The cron job set up in cPanel actually provided customer specific example showing customers login/paths ... just didn't show the specific path to customers moodle.
This shared for those that might be hosted on InMotion Hosting or other hosting sites that use cPanel and EasyApache.
Page at https://docs.moodle.org/36/en/Cron_with_web_hosting_services already says needs updating.
Only hoster specifically mentioned is 1and1
https://docs.moodle.org/36/en/Cron_on_1and1_shared_servers
Good hosters (like InMotion) do have docs of their own and are worth the ops time to locate and bookmark/favorite or whatever one does to keep a link.
In addition, this particular site had mod-security on for all domains ... OP opted to turn that off. So we may never know if it was mod-security that caused the issue or cron not running properly and frequently enough nor not.
'spirit of sharing', Ken