'Total' and 'total' are completely different fields. They cannot be used interchangeably. 'Total' is one result produced by the second
stats command. 'total' is null as it not a result from
stats. You probably want 'Total'.
You are getting different results because you are applying a sort to a nonexistent field when Total is capitalized and then doing a head 10. The sort is not being applied with a capital "Total" field so you get a different first 10 results with a head 10 than when you sort in descending order with a lower case total. There is nothing wrong or right here, it's just a mistake in your query due to case sensitivity of field names in Splunk.
It would match if you made it this:
index="YOURINDEX" |stats count by domain, id.orig_h | sort -count |stats list(domain) as Domain, list(count) as count sum(count) as Total by id.orig_h |sort -Total | head 10