Seen in several production clusters running 8.3 (thanks to the changes in #87881) but this also explains #86059 in earlier versions:

    [instance-0000000011] negative value in circuit breaker: [eql_sequence,limit=8589934592/8gb,estimated=-7961288

My guess is that somehow this circuit breaker is releasing bytes it didn't already hold. Seems pretty rare, and not covered by tests since it would trip assertions there.
x-pack/plugin/eql/src/test/java/org/elasticsearch/xpack/eql/execution/sequence/CircuitBreakerTests.java
i,
                        new BoxedQueryRequest(
                            () -> SearchSourceBuilder.searchSource().size(10).query(matchAllQuery()).terminateAfter(j),
                            "@timestamp",
                            emptyList(),
                            emptySet()
                        ),
                        keyExtractors,
                        tsExtractor,
                        null,
                        implicitTbExtractor,
                        false
                    )
                );
            }
            SequenceMatcher matcher = new SequenceMatcher(sequenceFiltersCount, false, TimeValue.MINUS_ONE, null, eqlCircuitBreaker);
            TumblingWindow window = new TumblingWindow(eqlClient, criteria, null, matcher);
            window.execute(wrap(p -> {}, ex -> {}));
            assertTrue(esClient.searchRequestsRemainingCount() == 0); 
            assertEquals(0, eqlCircuitBreaker.getTrippedCount()); 
            assertEquals(0, eqlCircuitBreaker.getUsed()); 
        }
    }
    /**
     *  A type of internal Node client that deals with three types of requests: open PIT, close PIT and SearchRequest.
     *  This class is used by {@code CircuitBreakerTests#testMemoryClearedOnSuccessfulRequest()} and
     *  {@code CircuitBreakerTests#testMemoryClearedOnShardsException()} methods to test the circuit breaker memory usage
     *  in case of a successful sequence request but also for a failed sequence request.
     */
    private abstract class ESMockClient extends NoOpClient {