Whenever I see things like this, my default is to think of runaway regex/GROK. I guess the better term might be Catastrophic Backtracking as talked about it in this article: Runaway Regular Expressions: Catastrophic Backtracking
It’s a long winded read for your question and not a solution but perhaps it will point you in the right direction…