Seen in several production clusters running 8.3 (thanks to the changes in #87881) but this also explains #86059 in earlier versions:

    [instance-0000000011] negative value in circuit breaker: [eql_sequence,limit=8589934592/8gb,estimated=-7961288

My guess is that somehow this circuit breaker is releasing bytes it didn't already hold. Seems pretty rare, and not covered by tests since it would trip assertions there.
x-pack/plugin/eql/src/main/java/org/elasticsearch/xpack/eql/execution/sequence/SequenceMatcher.java
if (group.isEmpty()) {
            keyToSequences.remove(previousStage, key);
            stageToKeys.remove(previousStage, key);
        }
        
        
        
        
        if (maxSpanInNanos > 0 && ordinal.timestamp().delta(sequence.startOrdinal().timestamp()) > maxSpanInNanos) {
            stats.rejectionMaxspan++;
            return;
        }
        
        UntilGroup until = keyToSequences.untilIfPresent(key);
        if (until != null) {
            Ordinal nearestUntil = until.before(ordinal);
            if (nearestUntil != null) {
                
                if (nearestUntil.between(sequence.ordinal(), ordinal)) {
                    stats.rejectionUntil++;
                    return;
                }
            }
        }
        sequence.putMatch(stage, ordinal, hit);
        
        if (stage == completionStage) {