Has my Linux box been compromised?

I recently started venturing into a few logging options. I recently setup a Security Onion instance and started using it to monitor some systems. Almost all of my servers at home are VM's running on a single host. In all these log files it will be called RedactedHostName. Judging from a few OSSEC logs, RHN seems like it may be compromised. I'm only monitoring a few of my VM's from within them so I don't have much to compare, but so far this is the only system that is sending me alerts so frequently. Could somebody knowledgeable please help me out and review these logs and let me know if I need to be worried or not? Thankfully this system isn't directly accessible from the internet, but once you are inside my network you are inside. I also have not seen any Suricata alerts with RHN's IP. I've searched through the BRO logs, but I didn't see anything out of place. However, I am a bit of a novice in this realm. I would appreciate any feedback or advice. I've just started learning about security, so if you know of any books that explain how to use some of the tools in Security Onion's tool chest, I'll happily Kindle those over the weekend.

Paste of the initial alerts I have been getting that started this rabbit hole: https://pastebin.com/Vsb1TBG4
lynis: http://pastebin.com/6hDqzLPx
rkhunter: http://pastebin.com/RTBuAb1d
chkrootkit: http://pastebin.com/usvnSWwL