Using PUBLIC here means “make these sources part of mylibA and also make them part of whoever links to mylibA”. That is how the sources are getting into your executable. You should probably be using PRIVATE here. Actually, I don’t see a reason for you to use target_sources() at all: just list the source files directly in the add_library() command, and they will be PRIVATE by default.
It’s extremely rare to need to use anything other than PRIVATE with target_sources(). I answered a similar question recently, see that for more info.