Censys expands queries to provide additional functionality. For example, the query a:zmap.io
executes a DNS lookup and expands to ip:184.108.40.206.
Your query was changed from:
validation.nss.valid: true and (validation.nss.type: intermediate or validation.nss.type: root)
validation.nss.valid: true AND (validation.nss.type: intermediate OR validation.nss.type: root)
If this isn't what you intended, you can run your raw query without expansion.