Oct 3 00:25:01 boydf5 debug crond[14048]: pam_unix(crond:session): session opened for user root by (uid=0)
Oct 3 00:25:01 boydf5 info crond[14049]: (root) CMD (/usr/lib/sa/sa1)
Oct 3 00:25:01 boydf5 debug crond[14048]: pam_unix(crond:session): session closed for user root
Oct 3 00:26:01 boydf5 debug crond[14050]: pam_unix(crond:session): session opened for user syscheck by (uid=0)those messages are from remotesyslog1 configuration (in case of gui, it is system > configuration > remote logging).
sorry i just noticed you are running 11.x.
The default syslog levels defined for the BIG-IP system logs apply to only local logs; the syslog levels do not apply to remote syslog servers that were defined using the tmsh modify /sys syslog remote-servers command.sol13333: Filtering log messages sent to remote syslog servers (11.x)
http://support.f5.com/kb/en-us/solutions/public/13000/300/sol13333.html