Is it running cron job to backup SQL databases at that time?

Every day I've been conducting a different test in attempt to determine what the problem is, and what the problem is not. I think the test that ran overnight finally showed what it is. ClamAV.

Now, I need to deep dive into that, and figure out how I can keep it, but it not bring my system down every night with scans.

You are exactly right, it is. After more digging, I've identified that clamav-freshclam is what initiates the problem. I am unsure, but I  think that clamav-daemon is the actual problem.

There has been a change in default configuration values for ClamAV between 0.104 and 0.105. There are several open GitHub issues about this, people are saying it's causing performance problems and increased scan times. My old iRedMail server that I built a couple years ago didn't have this issue, but my newly built one from maybe a month ago has this issue I've been digging into within this thread.

I found a tutorial online about fixing high resource usage via a systemd method.

I've modified this file:
/lib/systemd/system/clamav-daemon.service

And have added the following lines underneath the [Service] section of the file.

IOSchedulingPriority = 7
CPUSchedulingPolicy = 5
MemoryLimit=256M
CPUQuota=30%
Nice = 19

Then, I've reloaded configurations and restarted clamav-daemon with the following commands:

systemctl daemon-reload
systemctl restart clamav-daemon

I will report back if this has helped or not in the coming days.

Clamd 0.103.0 release notes say this:

Major changes

    clamd can now reload the signature database without blocking scanning. This multi-threaded database reload improvement was made possible thanks to a community effort.
        Non-blocking database reloads are now the default behavior. Some systems that are more constrained on RAM may need to disable non-blocking reloads, as it will temporarily consume double the amount of memory. We added a new clamd config option ConcurrentDatabaseReload, which may be set to no.

My issue is now resolved.

ROOT CAUSE:

Clamd 0.103.0 released a new feature to reload the signature database without blocking scanning. When this new feature is used, the amount of memory used by clamd is doubled briefly. This new functionality is enabled by default. On my iRedMail server, I have 4GB of ram. Clamd was using this new feature and consuming all available memory, causing system unresponsiveness.

CHOSEN SOLUTION:

Turn off the new clamd feature.

Modify this file:
/etc/clamav/clamd.conf

Add this line:
ConcurrentDatabaseReload false

Save the file. Then do the following to restart clamd:
systemctl restart clamav-daemon

OTHER SOLUTION:

Increase system memory to allow for the new clamd feature to operate.