I don't fully remember, but I don't think you can deny commands through can target through the group you are in.
You'd have to specify each moderator command as ^,!%moderator
Or, you have a major inheritance tree issue.
Do a ulx debuginfo from server console and attach the file from the path it tells you in server console to your next post.
See also from our FAQs section.
How exactly does can_target work?