I checked and noticed that some hosts had a vuln Apache.
Grabbed from SamDrucker:
samdrucker=# select host from hostswithpackageshowversion('apache24');
Some hosts didn't enable Apache - they had it installed, but didn't run it.
Fallout from https://github.com/freebsd/pkg/issues/2481