I assume it would make sense to send Audit events only through encrypted channels. But I did not find anything in Part 4 (6.5 Auditing) or Part 5 (6.4.3 AuditEventType - 6.4.27).

The only related text is in OPC UA Part 2:
4.14 Auditing
4.14.1 General
In addition, the information in an audit record may contain sensitive or private information, thus the ability to subscribe for Audit Events is restricted to appropriate users and/or applications. As an alternative, the fields with sensitive or private information can instead contain an error code indicating access denied for users that do not have appropriate rights.

But Part 2 is not normative and we should have a stronger statement in a normative part for this question. The text talks only about authorization but it makes no sense to send information to authorized users/applications but to use a unencryted channel.