Why does the server show abnormal activity every 7 am?

Question

PHP

Good afternoon, dear participants of this wonderful resource.
There was a strange situation here with one of our servers. Many people have already worked with it, not only me, a couple of sites are spinning on it, maybe something else small. And here's the problem: every 7 am, some incomprehensible activity is being conducted on it, php5-fpm and mysql services start to eat up all available RAM, and after that very often MySQL simply crashes due to lack of RAM.
Naturally, the first thing I looked at was crontab's of all system users and root. But there is nothing scheduled for 7 in the morning, there is nothing even close to the schedules by this time. What else can be? Where to look? Obviously, the load is related to our sites, but I can not understand what exactly it is called, and where to watch it. Our sites do not perform any scheduled tasks on their own, everything is done only through cron.
Thank you very much in advance.

Answer 1

backups, most likely
check what timezone the server
has and you need to look not at the cron,
but at the logs of the same cron

Answer 2

If you know what is fpm and mysql. So what prevents you from including logging in them and seeing what kind of requests, from where and in what quantity they fly?

Answer 3

Always at the same time?
What operating system?
How did crontab look?
In /etc/cron.d (in Centos you can throw individual tasks here) or crontab -l
Why didn't you see which process is loading php? ps aux | grep php