Maybe that particular subdomain is getting treated as the default virtual host by Apache? Are the other subdomains receiving scans too?

I don’t use Apache much, but NGINX sometimes surprises on what it uses if the default is not specifically defined.