There are other factors (like how hosted and if server has easy-apache or similar), but there is now a path to php-cli (command line php) in paths of the 3.6 moodle. Use Admin search box for 'path' and you'll find it.
That should be set to the path to php-cli.
Ssh into server and issue 'which php'.
That should show the path to the php executable that would be used in such things like cron you've setup.
If 'which php' shows /usr/bin/php find out if that's php-cli or not:
/usr/bin/php -v (asking for version).
On the top line of the output of above you'll see (cli).
If you don't see (cli) it's the web based php.
Now one needs to look at root user environment.
Type: env [ENTER]
You are looking for a PATH: line.
Those are the paths operating system (cli issued commands) will use to find whatever.
Also, in conjunction with the above, a find command to find all files that have 'php' as it's name ... we are looking for the php executable.
find / -name php [ENTER]
For every php it finds try the -v with the full path until we find the full path that responds with (cli) to -v.
Have assisted 4-5 users now and they hosted on 4-5 different providers that had cpanel and used easy-apache - you will see references to easy apache in the PATH variable env and listed first before anything else. More often than not a server setup that way, the php-cli was located at /usr/local/bin/php and that's what you should be using with cron. Now you could try that without any sluething above, but best to know by which/find/ -v to know for sure.
Also check in Moodle Admin interface, Scheduled Task for scheduling of various task which are run as parts to the cron. If you set the path to php-cli correctly you can 'Run Now' the individual task and watch them individually for execution and clues.
And also see the ownerships and permissions on moodledata/lock directory.
Be liberal with permissions of moodledata/lock/ and it's contents. chmod ugo+rwx moodledata/lock -R
'spirit of sharing', Ken