The documentation on the RequestObject field of the audit.Event reads:

API object from the request, in JSON format. The RequestObject is recorded as-is in the request
(possibly re-encoded as JSON), prior to version conversion, defaulting, admission or
merging. It is an external versioned object type, and may not be a valid object on its own.
Omitted for non-resource requests. Only logged at Request Level and higher.

This doesn't really fit the patch request model, which specifies an array of field operations rather than an actual object. E.g.

  "requestObject": [
    {
      "op": "replace",
      "path": "/spec/parallelism",
      "value": 0
    },
    {
      "op": "remove",
      "path": "/spec/template/spec/containers/0/terminationMessagePolicy"
    },
    {
      "op": "remove",
      "path": "/spec/template/spec/schedulerName"
    },
    {
      "op": "remove",
      "path": "/spec/template/spec/affinity"
    },
    {
      "op": "remove",
      "path": "/spec/backoffLimit"
    }
  ],

We should determine what the expected behavior is for a patch request. If this is working as intended, we should at least document this case.

/kind bug
/sig auth
/priority important-soon