Seen in several production clusters running 8.3 (thanks to the changes in #87881) but this also explains #86059 in earlier versions:

    [instance-0000000011] negative value in circuit breaker: [eql_sequence,limit=8589934592/8gb,estimated=-7961288

My guess is that somehow this circuit breaker is releasing bytes it didn't already hold. Seems pretty rare, and not covered by tests since it would trip assertions there.
x-pack/plugin/eql/src/main/java/org/elasticsearch/xpack/eql/execution/sequence/SequenceMatcher.java
* and adjust insertion positions.
     */
    void trim(Ordinal ordinal) {
        
        
        
        if (ordinal == null) {
            keyToSequences.clear();
        } else {
            
            keyToSequences.trimToTail(ordinal);
        }
    }
    public Stats stats() {
        return stats;
    }
    public void clear() {
        stats.clear();
        keyToSequences.clear();
        stageToKeys.clear();
        completed.clear();
        clearCircuitBreaker();
    }
    private long ramBytesUsedInFlight() {
        return RamUsageEstimator.sizeOf(keyToSequences) + RamUsageEstimator.sizeOf(stageToKeys);
    }
    private long ramBytesUsedCompleted() {
        return RamUsageEstimator.sizeOfCollection(completed);
    }
    private void addMemory(long bytes, String label) {