The “500” errors are not normal if you don’t have anything intentionally blocking xmlrpc.php, but it could be something else your host is doing. A 500 error is usually shown as an “Internal server error” when a visitor sees it, but it looks like these are attempts to break in, in one way or another.
I think mod_security may not appear in phpinfo even if it’s installed. (It’s an apache module, and not a php extension — some Apache servers may show it in a string that phpinfo would show, but some may hide it.)
The wp-login.php attempts in your log look like normal (bad) login attempts, but I don’t know why some of them might have shown up as non-existent pages. I do see one in the log you had sent where someone tried to access /blog/wp-login.php though, which is another one that bots sometimes test (by guessing it might exist).
Your host may be able to tell you more about what happened on any of those visits with the “500” response code, or you might find details in your site’s error log file.
