I'm not a huge fan of running periodic tasks through the public-facing app, but it works. One of the problems would be if the public hit the app with so many requests that there weren't available workers to serve the cron jobs. Another problem is the potential for hackers who found your source code to issue bogus cron tasks from the public.

An easy solution is to run another copy of the Catalyst app (or even a second Catalyst app entirely) for handling cron tasks, and not expose it to the public. This also lets you restart them independently, knowing whether you're disrupting the users or crashing a long-running cron task.