I'm using 1.3.5d as sftp and has very similar behaviour:
cat proftpd.log
2017-12-20 19:37:24,213 sim-ng-data proftpd[15698] sim-ng-data
(OpenWrt[192.168.3.180]): SSH2 session opened.
2017-12-20 16:37:24,339 sim-ng-data proftpd[15698] sim-ng-data
(OpenWrt[192.168.3.180]): USER ftp: Login successful
2017-12-20 16:37:24,339 sim-ng-data proftpd[15698] sim-ng-data
(OpenWrt[192.168.3.180]): ProFTPD terminating (signal 11)
2017-12-20 16:37:24,340 sim-ng-data proftpd[15698] sim-ng-data
(OpenWrt[192.168.3.180]): SSH2 session closed.
cat sftp.log
2017-12-20 19:37:24,213 mod_sftp/0.9.9[15698]: error using DisplayLogin
'welcome.msg': No such file or directory
2017-12-20 19:37:24,214 mod_sftp/0.9.9[15698]: sent server version
'SSH-2.0-mod_sftp/0.9.9'
2017-12-20 19:37:24,214 mod_sftp/0.9.9[15698]: received client version
'SSH-2.0-FileZilla_3.29.0'
2017-12-20 19:37:24,214 mod_sftp/0.9.9[15698]: handling connection from
SSH2 client 'FileZilla_3.29.0'
2017-12-20 19:37:24,225 mod_sftp/0.9.9[15698]: + Session key exchange:
ecdh-sha2-nistp256
2017-12-20 19:37:24,225 mod_sftp/0.9.9[15698]: + Session server
hostkey: ssh-rsa
2017-12-20 19:37:24,225 mod_sftp/0.9.9[15698]: + Session
client-to-server encryption: aes256-ctr
2017-12-20 19:37:24,225 mod_sftp/0.9.9[15698]: + Session
server-to-client encryption: aes256-ctr
2017-12-20 19:37:24,225 mod_sftp/0.9.9[15698]: + Session
client-to-server MAC: hmac-sha2-256
2017-12-20 19:37:24,225 mod_sftp/0.9.9[15698]: + Session
server-to-client MAC: hmac-sha2-256
2017-12-20 19:37:24,225 mod_sftp/0.9.9[15698]: + Session
client-to-server compression: none
2017-12-20 19:37:24,225 mod_sftp/0.9.9[15698]: + Session
server-to-client compression: none
2017-12-20 19:37:24,273 mod_sftp/0.9.9[15698]: sending acceptable
userauth methods: keyboard-interactive,password
2017-12-20 19:37:24,335 mod_sftp/0.9.9[15698]: sending userauth banner
2017-12-20 19:37:24,336 mod_sftp/0.9.9[15698]: sending userauth banner
2017-12-20 16:37:24,339 mod_sftp/0.9.9[15698]: sending userauth success
2017-12-20 16:37:24,339 mod_sftp/0.9.9[15698]: user 'ftp' authenticated
via 'keyboard-interactive' method
also looks like part of logging system working in UTC, but part is in
local time
