You are using the Logs Explorer in the Google Cloud Console. You want to write a query to filter the logs so that you ONLY see Admin Activity audit logs related to Compute Engine instances.

Which query filter should you use?

In Cloud Logging, Admin Activity audit logs are stored under the log name `cloudaudit.googleapis.com/activity`. To narrow the search to only Compute Engine VMs, you add a filter for the resource type `gce_instance`. Combining these gives you exactly the administrative actions performed on VMs.