target_sources adds source files to a target, just like target_compile_options adds compilation options to it etc.
With all these commands, PRIVATE means “this applies only to the target itself” and PUBLIC means “this applies both to the target itself and to anyone who links to it.”(1)
In other words, marking a source files as PUBLIC means “add this source file to this target and also to all targets which link to it.” In particular, it does not mean “this header is intended for public consumption.”
So, it’s very rarely useful to mark a source file as PUBLIC, and I can’t think of a situation where it would make sense to do so for a header. In particular, note that it does not give the consuming target any include-path access to the file.
As a rule of thumb, don’t mark source files as anything other than PRIVATE. If you do encounter a situation where you need to deviate from that, you will probably know it by just how extraordinary it is.
If you wanted to signal "a.h is a public API header of the library," you’d actually do that by setting the library’s target_include_directories(a PUBLIC ...) so that whoever links against a gets the correct paths to be able to do #include "a.h".
(1) And for completeness, INTERFACE means "this applies only to those who link against the target. So PUBLIC is the union of PRIVATE and INTERFACE.