You want to know why on different DDI devices, the TMSP log upload time in the crontab file are different from those in the log upload frequency setting on the WebUI.
For example, one DDI starts log upload at 0:58, followed by 6:58, 12:58, 18:58, the other one starts log upload at 0:03,followed by 6:03, 12:03, 18:03.
This is a product specification of DDI. The log upload start time (minute number) is determined by the time when the log upload frequency setting is set/changed.
For example, at 17:33, in Administration > Global Settings > Network Interface Settings > Threat Management Services Portal > "Send logs every”, you changed TMSP upload interval to 1 day, saved the setting and then changed the interval back to every 6 hours. You will notice that the log upload will start at 0:33, followed by 6:33, 12:33, 18:33.