ASM jobs are always executed on the Node Controller.
Content Inspection always determines the profile on the Node Controller and delegates the execution to an available Working Node.
The SAP module can only be configured on the Node Controller for receiving IDocs since only one system is allowed to do so (because of the acknowledgement). The Working Nodes are only allowed to send. Otherwise, the system that was last logged into the SAP system would receive the IDocs.
A DMZ server always has to refer to the Node Controller.
Cron jobs and data queue accesses are executed on the Node Controller if not otherwise defined. If the option "Run in background "(Cron Job -> File -> Settings) is active, the jobs will be delegated to the Working Nodes. If it is not, they will be executed on the Node Controller.