Debian: Why does the access.log file contain messages from auth.log?

Question

Debian

I can't figure out why the /var/log/apache2/access.log file, which should contain only Apache messages, has
the system messages from the /var/log/auth.log file mixed in?
Here is an example access.log content:
xx.xx.xx.xx - - [13/Jul/2019:07:25:23 +0300] "GET /images/karbamid-slider.png HTTP/1.1" 304 3483 " https: //xx.xx/ " "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.100 Safari/537.36"
xx.xx.xx.xx - - [13/ Jul/2019:07:25:24 +0300] "GET /favicon.ico HTTP/1.1" 404 530 " https://xx.xx/ " "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.100 Safari/537.36"
Jul 13 07:25:25 s197295 sshd[9167]: Invalid user ann from xx.xx.xx.xx port 34108
Jul 13 07:25:25 s197295 sshd[9167]: input_userauth_request: invalid user ann [preauth]
Jul 13 07 :25:25 s197295 sshd[9167]: pam_unix(sshd:auth): check pass; user unknown
Jul 13 07:25:25 s197295 sshd[9167]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=xx.xx.xx.xx
Jul 13 07:25:25 s197295 sshd[9160]: Failed password for root from xx.xx.xx.xx port 56301 ssh2
System: Debian 9
Server version: Apache/2.4.25 (Debian)