Yes there is data that matches the criteria of the IN condition. When I remove the clause with the IN, I get all kinds of records that look like they match the criteria. The tbl.costcenter is a string of 3 characters, but it only contains numbers which are zero padded, like '001', '540', '900'. There should be no room for odd characters, even though users do enter this number.
Also I tried a case-insensitive regex, and that didn't work either. Ex:
AND (tbl.costcenter ~* '(540|001|900)')