Finally fixed by ignoring senders timezone. This system-ng config works as it should (you can propably change only ISOTIME to R_ISOTIME, if you are comfortable with default format)
destination messages {
file("/var/log/messages" suppress(5) template("${R_YEAR}-${R_MONTH}-${R_DAY} ${R_HOUR}:${R_MIN}:${R_SEC} ${PRIORITY} ${PROGRAM}[${PID}]: ${MSGONLY}\n") log_fifo_size(256));
};
destination cron {
file("/var/log/cron" suppress(5) template("${R_YEAR}-${R_MONTH}-${R_DAY} ${R_HOUR}:${R_MIN}:${R_SEC} ${PRIORITY} ${PROGRAM}[${PID}]: ${MSGONLY}\n") log_fifo_size(256));
};
Result:
2017-03-12 20:48:49 notice syslog-ng[29601]: syslog-ng shutting down; version='3.0.9'
2017-03-12 20:48:49 notice syslog-ng[29650]: syslog-ng starting up; version='3.0.9'
2017-03-12 20:49:06 info sshd[29666]: Accepted publickey for root
2017-03-12 20:52:01 info /usr/sbin/cron[29854]: (root) CMD (nethist_stats.lua)
2017-03-12 20:54:01 info /usr/sbin/cron[30020]: (root) CMD (nethist_stats.lua)
date
Sun Mar 12 20:55:11 CET 2017
This doesnt solve the root cause, just syslog output, so maybe statistics/collect will be still shifted, but I cant test it myself.