What would intermittently cause less events to return the raw data versus the total number of events it says it matched on?

This has been happening every now and then on our instance where we will have users run a search, it says it will return some number of events, let's say 20, but only 2 will actually show below where you can look at what the events actually contain. You could run the same exact search later and it will give you all the data, or some other user can run it and it will give you all the data. What are some possible reasons for why it would do this? Clearly the query detected the events, so why isn't it returning it in the data?