Seen in several production clusters running 8.3 (thanks to the changes in #87881) but this also explains #86059 in earlier versions:

    [instance-0000000011] negative value in circuit breaker: [eql_sequence,limit=8589934592/8gb,estimated=-7961288

My guess is that somehow this circuit breaker is releasing bytes it didn't already hold. Seems pretty rare, and not covered by tests since it would trip assertions there.
x-pack/plugin/eql/src/main/java/org/elasticsearch/xpack/eql/execution/sequence/SequenceMatcher.java
* Used to see whether, after rebasing a window it makes sense to continue finding matches.
     * If there are no in-progress windows, any future results are unnecessary.
     */
    boolean hasCandidates() {
        return hasCandidates(0, completionStage);
    }
    private boolean hasCandidates(int start, int stop) {
        for (int i = start; i < stop; i++) {
            if (stageToKeys.isEmpty(i) == false) {
                return true;
            }
        }
        return false;
    }
    Set<SequenceKey> keys(int stage) {
        return stageToKeys.keys(stage);
    }
    Set<SequenceKey> keys() {
        return stageToKeys.keys();
    }
    List<Sequence> completed() {
        List<Sequence> asList = new ArrayList<>(completed);
        return limit != null ? limit.view(asList) : asList;
    }
    void until(Iterable<KeyAndOrdinal> markers) {
        keyToSequences.until(markers);
    }
    /**
     * Called when moving to a new page.
     * This allows the matcher to keep only the last match per stage