As background, Zen Cart's catalog side uses a front controller called index.php. Everything on the catalog side should go through there. It's the front door that controls access to your catalog.

So there's nothing unusual in seeing that as the overwhelming source of page loads. That there are others is actually more worrying (though not by much) as it's probably people looking for other ways in (not worrying because they very unlikely to succeed if your code is up to date).