Well, not a "solution" per se, but I got a big improvement on this. Owncloud is installed on a Debian server; yesterday I upgraded it from Jessie to Stretch. I guess the PHP update (from 5.6 to 7) makes a big difference; it still uses a lot of RAM to do the cron job, but much less than before. And, no doubt, it loads faster. I'll keep investigating...
This isn't enough information to start investigating. Anyone could say that "you modified a file somewhere" or "you installed a rogue app and is causing that problem".
When you open a new post there is a template to fill, specially if it's a bug report such as this. The template contains basic information that is required to help you.
In addition to the information in the template, we'll need to know which user is executing the cron.php file. It should the "www-data" or "apache", but not root. Debug logs should also show what cron job is being executed during that spike (not directly, but it should be possible to check what jobs are being executed during that time).
As far as I know, this is the first complain about this that I'm aware of. Feel free to link issues.