or have I just figured this out myself ? ;)
Indeed I have.
Failed GET requests, to some domain my configuration doesn't know about, end up in the top level access.log
But for any of the domains (virtual hosts) I am serving, those access log entries end up in the access log for that virtual...