I have same issue and for now found out that the only query_match ACL which I have in my instance is *.* 

It should give access to the query_match operations to if user have READ rights on table/record but in my case users have READ access on sys_choice but still this error shows up and mess with few custom fields in incident form.

I'm investigating that with a team further and if we'll find anything I'll post update here