[Security Solution] [Detections] Sporadic 400's when using value lists with CIDR notation

[dhurley14]

Describe the bug:
Some reported cases where sorting an ip value list using CIDR notation can lead to sporadic 400 errors coming back in the form of search_phase_exception. Have not been able reproduce reliably on my local machine nor identify the root cause. Opening this bug report to track other instances of this and associated work.

Kibana/Elasticsearch Stack version:
Originally reported on 8.15.1

Functional Area (e.g. Endpoint management, timelines, resolver, etc.):
Security Solution - Detections and Response

Steps to reproduce:

1. Navigate to value list modal on detection rules management page.
2. Upload value list of ip ranges such as 198.51.100.0/22
3. Attempt to sort the list, sorting may sporadically fail with errors logged in the network tab of browser dev tools.

Current behavior:
Sorting fails sporadically - unclear if values are not visible or remain visible on the UI.

Expected behavior:
Consistently successful sorting of ip ranges with CIDR notation in the given value list
Screenshots (if relevant):

Errors in browser console (if relevant):

Provide logs and/or server output (if relevant):

Any additional context (logs, chat logs, magical formulas, etc.):

Request URL:
https://my-cloud-instance.cloud.es.io/api/lists/items/_find?page=1&per_page=25&sort_field=value&sort_order=asc&list_id=ip.txt&filter=
Request Method:
GET
Status Code:
400 Bad Request

Response: {"message":"search_phase_execution_exception: ","status_code":400}

[elasticmachine]

Pinging @elastic/security-solution (Team: SecuritySolution)

[elasticmachine]

Pinging @elastic/security-detections-response (Team:Detections and Resp)