I am getting this too, I saw this the logs a few months ago and didn't think anything of it.
I wouldn't worry about it. Faravahar has a long history of misbehavior:
https://lists.torproject.org/pipermail/tor-relays/2015-November/008097.html https://lists.torproject.org/pipermail/tor-relays/2017-January/011627.html
(and other threads, I'm sure.)
It has some sort of caching proxy in front of it, which seems to be responsible for the occasional 502 errors.
this time though I ran Wireshark while started tor, and it appears tor is transmitting encrypted info over port 80.
Surely tor shouldn't be transmitting unencrypted messages?
I'm not an expert on the protocol but you may just be looking at responses from the proxy in front of Faravahar?