Like a normal (not same-site) cookie the Authorization header for Basic Authentication is always send with a normal HTTP request when the site is accessed and credentials are known, no matter if cross-site or not. There is no way to specify a different policy for this header.
This format is used by a kind of HTTP proxy.
Unless your server is actually misconfigured or hacked to be used as a proxy (you should get rid of the browser limitation and test it out), it may have the following possibilities:
Someone is scanning a wide range of IP addresses for open proxies.
Someone is testing the availability of an open proxy once existed ...
There's nothing bad in that as long as you're subscribed to any security updates list and keep an eye on vulnerabilities.
Also, do subscribe to this module future releases: if you see any mentions of CVEs or fixed bugs, you may want to upgrade.