We have a Linux box (Ubuntu VERSION="18.04.2 LTS (Bionic Beaver)" that hosts MySQL. When I check the MySQL logs I see constant failed attempts to log in from root@localhost. does this imply that I have malware in the same box or some attacker can pretend to be the localhost?
From our conversation in the comments, it looks like someone (either at the IP that you posted, or proxying through it) may be trying to compromise your system by exploiting your phpmyadmin. If you are not using phpmyadmin, you might want to uninstall it or disable it. If you need it, you might want to follow the steps described here to better secure it.