User(s) with only read permissions have update event in audit log

I have a SharePoint online site that I am running a custom audit log on. As I was looking over the log, I noticed that some users are listed with update events on documents that they only have permission to read. When I go and look at the document in the document library, this is no modification to the file. Is this the way that SharePoint online audit log says that a user downloaded the file? Thanks!