I'm betting that the mac address is being tokenized on the colons, creating several unique search terms. So when you search, you get any mac address that matches any of the two character hex values. The same way you'd get the document "cat dog" if you just searched for "cat mouse." Phrase queries work because it enforces that each term is adjacent, much like you might search with quotes on Google for "cat dog"
You probably want this field to be not_analyzed which will only allow exact matches. However you may also want to perform lowercasing as case doesn't matter in hex values.