In your first screen shot there is a line that says something about 'intervention' and 'slow network'. Have not a clue as to what that means ... I have a Google Compute Engine instance of CentOS 7 (image provided by Google) and have no such issues.
However, I do not have cPanel ... which also provides 'icons' to other apps/scripts supposedly to make admin of server easier.
So what sort of 'tools' related to 'intervening' (assuming translation of 'intervention' is in a human term ... 'protection')? Some sort of something designed to 'protect' apps.
Don't re-call ever seeing anything in cPanels I've been granted access to on other providers related to networking but ... could be one in yours, I guess.
'offesetting paths' to a linux machine would, I think, be symlinks or aliases but the files are part of moodle code and I've never seen moodle code use symlinks/aliases.
Soooooo .... ????
Keep digging!
'SoS', Ken