Seen in several production clusters running 8.3 (thanks to the changes in #87881) but this also explains #86059 in earlier versions:

    [instance-0000000011] negative value in circuit breaker: [eql_sequence,limit=8589934592/8gb,estimated=-7961288

My guess is that somehow this circuit breaker is releasing bytes it didn't already hold. Seems pretty rare, and not covered by tests since it would trip assertions there.
x-pack/plugin/eql/src/main/java/org/elasticsearch/xpack/eql/execution/sequence/SequenceMatcher.java
totalRamBytesUsed += bytes;
        circuitBreaker.addEstimateBytesAndMaybeBreak(bytes, label);
    }
    private void clearCircuitBreaker() {
        circuitBreaker.addWithoutBreaking(-totalRamBytesUsed);
        totalRamBytesUsed = 0;
    }
    
    
    
    
    
    private void trackMemory(long prevRamBytesUsedInflight, long prevRamBytesUsedCompleted) {
        long bytesDiff = ramBytesUsedInFlight() - prevRamBytesUsedInflight;
        addMemory(bytesDiff, CB_INFLIGHT_LABEL);
        bytesDiff = ramBytesUsedCompleted() - prevRamBytesUsedCompleted;
        addMemory(bytesDiff, CB_COMPLETED_LABEL);
    }
    @Override
    public String toString() {
        return LoggerMessageFormat.format(
            null,
            "Tracking [{}] keys with [{}] completed and {} in-flight",
            keyToSequences,
            completed.size(),
            stageToKeys
        );
    }
}