How to read auth.logs in AWS ec2 instance logs?

We were looking into this file, /var/logs/auth.logs and shows this:

enter image description here

(Question 1:) Is this a possible hack attempt?

Using this website https://www.abuseipdb.com/check/59.173.173.107 I can track the origin of the IP address.

I also run this command last and shows this:

enter image description here

Can anyone please tell me what are this are? Thanks!
(Question 2:) What is the difference of last and auth.logs?

(Question 3:) What is CRON[17637] and sshd[17686]?
(Question 4:) What does this line mean, Received disconnect from 59.173.173.107: 11: Normal Shutdown, Thank you for playing [preauth]?
(Question 5:) Is this normal? Does everyone always get this?