The path is just the path of the request, being /image, it wouldn’t contain your query parameter, ?r=...
What you want is likely the entire request URI “Represents the URI path and query string of the request.” http.request.uri, which is just called “URI” in the expression editor.
If you use contains, just like you tried with the other field, yes. You could use startsWith as well if you wanted to be more precise (have to include slash at start though). The docs linked above give examples of all of the fields.