Yes, it’s normal.

If you look at the logs, the bots are probably all trying to exploit some Webpress vulnerability or trying random passwords in /login.php.