Paraphrasing Basti from this comment:
The runtime upgrade to Polkadot 0.8.28 had the following migration: https://github.com/paritytech/polkadot/blob/371681c298eb96b74ad04a09ca8097f19c777e68/runtime/polkadot/src/lib.rs#L968
The second parameter to the apply function was the old CandidacyBond. It was passed as 1 DOT while it was actually in the release before: 100 DOT.
The result is now that some accounts only got 1 DOT unreserved, while it should have been 100 DOT.
This referenda calls Balances::force_unreserve for the two accounts which had incorrect amounts unreserved.
See this issue for more information.