KACE Product Support

I have a mac that is using our K1 replication share credentials to contact dl.google.com during the detect+deploy patching process. Is this normal?  There was a chrome update that was being patched and it looks like this k1 share user account was attempting to update a chrome extension.  I thought all patching was going through the K1 and the agents did not pull patches directly from the software manufacturer.  Does kpatch run using the k1 replication share credentials?  Can someone provide me more information on how Kace handles google updates?