What cron expression runs Monday to Friday?

Use 0 9 * * 1-5 for 09:00 Monday to Friday in standard 5-field cron.

Why does a weekday cron sometimes run on weekends?

Weekend runs usually happen due to timezone mismatch or using * in day-of-week by accident. Validate next runs in the target timezone.

For weekdays, use day-of-week 1-5 in standard 5-field cron.

09:00 Monday–Friday

0 9 * * 1-5

Every 30 mins on weekdays

*/30 * * * 1-5

17:30 Monday–Friday

30 17 * * 1-5

Some systems also allow names like MON-FRI, but numeric values are the safest portable option.
Weekend runs usually come from timezone mismatch or using * in the weekday field by mistake.