Hello!
What you’re finding is normal, intended, and expected behavior.
Somewhere on your site, a link to the /wp-admin/upload.php was provided.
Because we disallow /wp-admin/, all links leading to /wp-admin/* will be blocked — this includes the /wp-admin/upload.php file.
There’s but one exception: /wp-admin/admin-ajax.php. We allow this one file because it’s also used in non-admin scenarios (such as loading a page via AJAX on the front-end); blocking that would stop crawling the AJAX-loaded page.
Via the Indexing report, at “Blocked by robots.txt”, click on the URL at the Examples.
Then, click on “Inspect URL.” You may be able to find the “Referring page” there.
The “Referring page” is where Google found the URL and followed it.
Sometimes, they may even take plain text that somehow looks like a URL and follow that, as was the case with us, where Google followed a URL from a code snippet:
You can learn more about robots.txt here: https://developers.google.com/search/docs/crawling-indexing/robots/intro.
I hope this explains everything well. Let me know if you have any more questions!