Does your web crawler run as a non-root user and not in sudoers? Does sudoers allow passwordless sudo? Could it be the crawler hit a malicious URL designed to trick crawlers into executing commands or code using a parsing
bug?
Or by chance does your crawler or some other package have a web UI that utilizes Apache as a dependency but you perhaps have always used the CLI? By default apache should not be running as root. There should be an suexec in the configuration file and the child processes should be running as a non-root service account. Are there any comments possibly left by a script in the config?
Do you have package installation logs in /var/log somewhere? I dont use the Ubuntu variants so not sure which log this would be. Maybe /var/log/apt/? or /var/log/dpkg.log or maybe there are entries in /var/log/messages? Packages installed just prior to or just after apache2 may give some clues as to what pulled it in as a dependency.