Select2 AJAX and WP Query Returns ALL and does not filter

The param name is s not search.
So your query ignores the search param and returns all cpts.
And your $_GET input should be sanitized before use.

's' => sanitize_text_field( $_GET['q'] ),