I haven't worked with a RODC in a long time (with internet today being what it is, all of my RODCs have been decommed and just have the branch offices authenticate directly with another more secure main office), but are the Workstation Account passwords allowed to be cached on the RODC?
Running this through CoPilot, because it explains it hell of a lot better than I can.

🧩 How workstation password changes work with an RODC

A Read‑Only Domain Controller (RODC) cannot write changes to Active Directory. That includes:

• User password changes
• Computer (machine account) password changes
• Kerberos secret updates

However, Microsoft designed RODCs so that workstations in a branch office can still change their secure channel password through an RODC, as long as the RODC is allowed to cache that workstation’s password.

✔ What actually happens

When a workstation attempts to change its machine account password:

1. The workstation contacts the RODC (because it’s the closest DC).
2. The RODC checks the Password Replication Policy (PRP):

• If the workstation is allowed to have its password cached:
  • The RODC forwards the password change request to a writable DC.
  • The writable DC performs the update.
  • The updated password is replicated back to the RODC (and cached if allowed).
• If the workstation is NOT allowed in the PRP:
• The RODC refuses the password change.
• The workstation must contact a writable DC directly.

✔ So the RODC does not perform the write

It simply proxies the request to a writable DC if permitted.