A website I manage is listing numerous crawl errors in Google Search Console for URLs that don't exist on my site and never existed. eg Images/mage.asp?id=buy-my-dodgy-pharmaceuticals-12345.html
When I view the "Linked from" for the link, some of them show the exact same link within my site that the error was for, which doesn't exist. Others show links within my site that do or don't exist, and also external links to other sites that are clearly spam or hacked sites. See the screenshot for an example (my site URL has been censored, but the spam link hasn't).
My site is a Wordpress site with up-to-date software that has been carefully secured using widely recommended techniques. There's no evidence I'm aware of that it's been hacked, and there's no spam comments/content that I'm aware of on the site either.
Why are these pages appearing in my Crawl Errors?