AsyncEqlSecurityIT failing in release build

[nik9000]

Build scan:
scan

Repro line:

./gradlew ':x-pack:plugin:eql:qa:security:integTestRunner' --tests "org.elasticsearch.xpack.eql.AsyncEqlSecurityIT.testWithUsers" -Dtests.seed=99F1444C053EB275 -Dtests.security.manager=true -Dbuild.snapshot=false -Dtests.jvm.argline="-Dbuild.snapshot=false" -Dtests.locale=ar-SA -Dtests.timezone=America/Cuiaba -Druntime.java=11

Reproduces locally?:
I don't have the infrastructure set up to do a release build so I don't know.
Applicable branches:

Failure history:
https://build-stats.elastic.co/goto/62d266803d232a5b414489a464cd02ae

Recently added

Failure excerpt:

org.elasticsearch.client.ResponseException: method [POST], host [http://[::1]:38473], URI [index/_eql/search?wait_for_completion_timeout=10s&keep_on_completion=true], status line [HTTP/1.1 400 Bad Request]

Is there a feature flag for this?

[elasticmachine]

Pinging @elastic/es-ql (:Query Languages/EQL)