When describing an SPI read transfer that includes a register address write phase, section 8.8.4 of the data sheet says: “After the transfer of the last address bit (bit 0), the I2C/SPI Master stops driving the MOSI line”. If that is literally true, then MOSI is floating while the IOM is reading. In section 8.8.6, the data sheet indicates that if the transfer is a raw read with no write of a register address to begin the transfer, then MOSI appears to be in a Hi-Z state for the whole duration. Maybe MOSI is just floating to 0 during your read. What if you added a 10K to 100K pullup on MOSI? If you still see a ‘0’ on MOSI after adding the resistor, then someone has to be driving it.