Code restricted to dashboard, running unexpectedly in the frontend (pre_get_post and admin-ajax.php)

Any ajax call to WP will likely call admin-ajax.php as that’s the way you’re meant to make ajax calls in WP. So your last condition will be true for many front end ajax calls and then you’re setting author -1 for all of those queries and excluding everything that User #1, generally the default Admin user, has written.

It’s probably better to use the wp_ajax_query_attachments hook instead which only fires in the context you want and so gives you a much more specific target for your query adjustment:

if ( is_admin() && !in_array( 'administrator', (array) $user->roles ) ) { 
    add_filter( 'ajax_query_attachments_args', 'exclude_admin_media', 1, 1 );
} 

function exclude_admin_media( $query ) { 

    $query['author'] = '-1'; 
    // exclude admin media 

    return $query; 
}