I have another cronjob that fits the same description, runs daily, and it's called "unattended security updates". Just saying.

Edit: Also, it's a persistent myth that certbot needs to run as root. It most certainly doesn't on my servers.