If you haven't already done so, running kubectl --v=100 get -w events will show you the equivalent pseudo-curl command that kubectl is invoking on your behalf

But if the behavior of kubectl logs is any indicator, yes, I would expect websockets are likely involved