I had look into the Lucene changes between version 8.9.0 (Elasticsearch 7.15) and 8.10.1 (Elasticsearch 7.16) and there is nothing suspicious that might have cause this.
I am assuming the mapping is the same and data between the two version equivalent. One thing you can try is to run the slower query in a loop and try to capture the hot threads to see if we can see where we are spending most of the time.
Note: It is a bad idea to map a field as an IP if you are going to perform terms queries. It would be much more efficient to map the field as keyword (if you are no going to rum range queries on it).