Thanks for the response @richcollier. I agree and understand that this behavior largely depends on the datasets. I was just wondering if there was specific rules for ML modeling algorithms in elastic which for example use this number of inputs for creating the first model and then start to raise anomalies for new incoming records which may makes some sense for this results? I may be able to provide a graph if that helps.
Regarding the cardinality, we had the same concern and had a population model. However, it looks that temporal model performs better here, probably because of different behaviors of entities. We still investigating the results though.