The point is that Apache user was changed to run as root. That setup is dangerous, and allows trivial hacks to escalate to root easily.
I would talk with previous sysadmins to at least have a minimum peace of mind this is not a backdoor left from a previous attack and is just a mistake.
I would also peruse old backups to investigate how long the Apache user has had that id.
Mistake or not, the odds are fairly high the machine was already compromised. (several times?)
It is also fairly common a rogue sysadmin or an attacker leaving behind a user with id 0. The id 0 gives any user the privileges of root.
I would not wait for any migration; at this point of the game, the question is not about changing the user id.
I would change the id, password of apache_user (if any), and the bash shell of that user for /bin/nologin as an immediate measure. However a possible hacker might have alternative entries by now.
Do an image/backup of that, and reinstall that server ASAP.
If you can recover the data files from a trusted backup even the better. Reinstalling might rid if of a root compromise for now, but is is possible to have rogue web shells left behind. As a begginer tip, search also for suspicious root setuid files out of place.
Consider hiring the services of a seasoned consultant to evaluate all of your systems. This server might be a point of entry on your infrat-structure.
There is also a remote possibily this was done as a sloppy way to not manage user permissions. Be prepared for your sites or some obscure funcionality failing in misterious ways after taking out root privileges from the apache user.