The one running as "apache" is the worker process. The one running as "root" is the master process. This is completely normal.
The master process will spawn workers as necessary (with whatever constraints are specified in the configuration file) to handle incoming traffic. It typically will need to be root in order to bind to low ports 80 and 443. After it binds, it will drop privileges to the apache user.
Workers will be reaped from time to time. The long-running process is the one running as root. If you look at httpd.conf, you'll see a block that looks something like:
So, the master process will spawn one worker in this example on startup. If there's more traffic, it will spawn more workers. Once workers serve 4000 requests, the worker will die, and the master process may spawn new worker processes, depending on traffic.