Seen in several production clusters running 8.3 (thanks to the changes in #87881) but this also explains #86059 in earlier versions:

    [instance-0000000011] negative value in circuit breaker: [eql_sequence,limit=8589934592/8gb,estimated=-7961288

My guess is that somehow this circuit breaker is releasing bytes it didn't already hold. Seems pretty rare, and not covered by tests since it would trip assertions there.
x-pack/plugin/eql/src/main/java/org/elasticsearch/xpack/eql/execution/sequence/SequenceMatcher.java
private static final String CB_INFLIGHT_LABEL = "sequence_inflight";
    private static final String CB_COMPLETED_LABEL = "sequence_completed";
    private final Logger log = LogManager.getLogger(SequenceMatcher.class);
    static class Stats {
        long seen = 0;
        long ignored = 0;
        long rejectionMaxspan = 0;
        long rejectionUntil = 0;
        @Override
        public String toString() {
            return LoggerMessageFormat.format(
                null,
                "Stats: Seen [{}]/Ignored [{}]/Rejected {Maxspan [{}]/Until [{}]}",
                seen,
                ignored,
                rejectionMaxspan,
                rejectionUntil
            );
        }
        public void clear() {
            seen = 0;
            ignored = 0;
            rejectionMaxspan = 0;
            rejectionUntil = 0;
        }
    }