Rangemap is a strange command - it is actually a custom command and written as a Python script. I would try this instead:
application response sourcetype=log1 OR sourcetype=log2 (host = host1 OR host = host2 OR host = host3 OR host = host4 )
| rex "(A|a)pplication response.*?time was\s+(?P<app_response>\d+)\s"
| where app_response >= 0
| eval appResponseCategory = case(
app_response<250,"A. Less than 0.25 seconds",
app_response>=250 AND app_response<500,"B. More than 0.25 but less than 0.5 seconds"
app_response>=500 AND app_response<1000,"C. More than half-second but less than a second"
"1"=="1","D. One second or more" )
Note that I eliminated events that did not have an application response time - this may be where your "extra" default events were arising. Also, I made sure that the categories did not overlap, as your original categories did at 500 (one-half second). Finally, I think that the case function will out-perform the rangemap command.
