Been through the wringer with both. Checkmarx feels like that over-engineered enterprise CRM—catching everything but drowning you in noise. SonarQube is more like the clean, opinionated tool that gets adoption because it's less infuriating.
For OWASP Top 10 specifically: Checkmarx will flag a potential SQL injection if you so much as look at a string variable. The false positive rate is brutal, especially on path traversal and XSS. You'll spend days tuning rules. SonarQube's default rules are more pragmatic. Fewer wild goose chases on injection flaws, but you might miss some obscure stuff. Their secret sauce is the quality gates—makes the FP trade-off actually manageable.
Bottom line: If your team likes to argue with the tool instead of fixing stuff, go Checkmarx. If you want to actually fix the Top 10 and move on, SonarQube.
CRM is a means, not an end.