Does Composer patch core automatically?
Composer doesn't patch core automatically, but the cweagans/composer-patches plugin allows dependencies to patch other dependencies if:


You have enable-patching set to true in the "extra" section of your root composer.json file, or
You have at least one patch defined in your root composer.json file


In your case, it looks like Lightning is pulling in those other core patches.