Though the captured name in the rex command got truncated, I'm assuming it was UserID. So, the field didn't exist in the base search (where you added filter NOT (userID=PSAPPSRV OR userID=GUEST ) ), hence the filter never took place. In fact if the NOT operator was not there, you would have 0 results. You should move the filter after the rex comand when its available. Like this
| rex field=_raw "GetCertificate\]\(3\) Returning context. ID=(?<userID[^,]*)"
| search NOT (userID=PSAPPSRV OR userID=GUEST )
| bucket _time span=1h
| top limit=2 userID by host, _time