Yes, it's hitting a lot of documents (about 1.9 million).
The structure of the query is identical to the other queries I'm using, it's only the query string values that change. But I've noticed that the good queries (the ones which don't cause the CPU usage spike) hit a fewer number of documents (<0.1 million).
The query actually takes as low as only 40ms to execute, but while load testing (300 concurrent requests with the same query), it's taking an average of 2s and goes up to even 10s.
Ah, I didn't realize that was the default behavior of match. I've modified the query with AND and fuzziness (which is the intended behavior) and will keep you updated with the new results. Thank you!