It depends a bit (on the specific distribution and the applications you've installed) which events get logged to /var/log/auth.log.
By default though: all events that that the applications/system components themselves mark with the syslog facility auth and/or authpriv, regardless of the syslog "security level" or "severity" of the event.
On most systems that means that the majority, if not all messages in that log will be informational, mostly harmless and certainly not important warnings or critical emergencies.
Oct 3 05:00:01 webv2 CRON[25757]: pam_unix(cron:session): session opened for user www-data(uid=33) by (uid=0)
Oct 3 05:00:01 webv2 CRON[25757]: pam_unix(cron:session): session closed for user www-data
Is that because I have some entries in the /etc/sudoers who allow www-data to start an file or am I wrong?
These are security events generated by your cron daemon and they simplified mean that a cron job, running with the effective user ID of "www-data" was started and completed.
They are only informational.
Oct 3 08:23:30 webv2 PackageKit: uid 1000 is trying to obtain org.freedesktop.packagekit.system-sources-refresh auth (only_trusted:0)
Oct 3 08:23:30 webv2 PackageKit: uid 1000 obtained auth for org.freedesktop.packagekit.system-sources-refresh
Oct 3 10:58:14 webv2 polkitd(authority=local): Unregistered Authentication Agent for unix-session:1 (system bus name :1.26, object path /org/freedesktop/PolicyKit1/AuthenticationAgent, locale de_AT.UTF-8) (disconnected from bus)
Oct 3 10:58:36 webv2 polkitd(authority=local): Registered Authentication Agent for unix-session:1 (system bus name :1.28 [lxpolkit], object path /org/freedesktop/PolicyKit1/AuthenticationAgent, locale de_AT.UTF-8)
That "Unregistered Authentication Agent" and "Registered Authentication Agent" make me feel not well.
Polkit polkitd (formerly PolicyKit) is a component for controlling system-wide privileges in Linux. An authentication helper program, the Authentication Agent, is started ("Registered") at the start of an authenticated session and stopped ("Unregistered") when the session ends.
Those are verbs, to register, to unregister, rather than adjectives implying something like (il-)legal (un-)trusted etc.
Also informational messages only.
Oct 3 10:58:58 webv2 login[722]: pam_unix(login:session): session opened for user pi(uid=1000) by LOGIN(uid=0)
The problem what i have with that msg is, that it isn't typical as the rest of the login msg's. is here something to be scared about?
That message basically says a login session was started for user ID "pi".
If that is unexpected or not, that completely depends on the user ID's you created and are using... Raspian and possibly other Raspberry specific distributions use that pi user ID as the default user though.
Again purely informational unless it concerns a service account user that shouldn't be logging in.
