I have seen multiple empty http request log entries from Apache:
HOST:443 REMOTEIP - - [DATA AND TIME] "-" SIZE SIZE "-" "-"
Are these malicious attacks, or some misconfiguration on my side?
Empty responses are perfectly normal if e.g. the HTTP return code is 304 (Not modified). The client sending the request is sending headers like If-Modified-Since or If-None-Matches and the server uses them to determine that nothing changed and sends an empty response, allowing the client to use its cached copy.