I've seen in my audit logs the following:

Audit.where(:auditable_id => 194, :auditable_type => 'Host').limit(20).reorder("created_at DESC").map(&:audited_changes)
  Audited::Adapters::ActiveRecord::Audit Load (1.3ms)  SELECT `audits`.* FROM `audits` WHERE `audits`.`auditable_id` = 194 AND `audits`.`auditable_type` = 'Host' ORDER BY created_at DESC LIMIT 20
=> [{"mac"=>["E4:1F:13:CC:36:C0", "e4:1f:13:cc:36:c0"]}, {"mac"=>["e4:1f:13:cc:36:c0", "E4:1F:13:CC:36:C0"]}, {"mac"=>["E4:1F:13:CC:36:C0", "e4:1f:13:cc:36:c0"]}, {"mac"=>["e4:1f:13:cc:36:c0", "E4:1F:13:CC:36:C0"]}, {"mac"=>["E4:1F:13:CC:36:C0", "e4:1f:13:cc:36:c0"]}, {"mac"=>["e4:1f:13:cc:36:c0", "E4:1F:13:CC:36:C0"], "ip"=>["10.35.27.6", "127.0.0.1"]}, {"mac"=>["E4:1F:13:CC:36:C0", "e4:1f:13:cc:36:c0"]}, {"mac"=>["e4:1f:13:cc:36:c0", "E4:1F:13:CC:36:C0"]}, {"mac"=>["E4:1F:13:CC:36:C0", "e4:1f:13:cc:36:c0"]}, {"mac"=>["e4:1f:13:cc:36:c0", "E4:1F:13:CC:36:C0"]}, {"mac"=>["E4:1F:13:CC:36:C0", "e4:1f:13:cc:36:c0"]}, {"mac"=>["e4:1f:13:cc:36:c0", "E4:1F:13:CC:36:C0"]}, {"mac"=>["E4:1F:13:CC:36:C0", "e4:1f:13:cc:36:c0"]}, {"mac"=>["e4:1f:13:cc:36:c0", "E4:1F:13:CC:36:C0"]}, {"mac"=>["E4:1F:13:CC:36:C0", "e4:1f:13:cc:36:c0"]}, {"mac"=>["e4:1f:13:cc:36:c0", "E4:1F:13:CC:36:C0"]}, {"mac"=>["E4:1F:13:CC:36:C0", "e4:1f:13:cc:36:c0"]}, {"mac"=>["e4:1f:13:cc:36:c0", "E4:1F:13:CC:36:C0"]}, {"mac"=>["E4:1F:13:CC:36:C0", "e4:1f:13:cc:36:c0"]}, {"mac"=>["e4:1f:13:cc:36:c0", "E4:1F:13:CC:36:C0"]}]