No, when a user deletes an activity from a course, this event is logged in the logs twice: once when they delete the activity and then immediately when it is put into the Recycle bin (where it will remain until the time set for cron to actually delete it from the site.) The user does the deletion and the moving to the Recycle bin. Cron itself only does the very final deletion.
The logs tell you which user did this. The event is named "Course module deleted."
Please see the attached screenshot for an example of what this looks like.
