Yes - it’s doing what it is specified to do. What people don’t realise is that there are in fact very few companies which would have values for this endpoint. Very few opt to maintain their registers with Companies House / on the public register. So for almost every company you request this for you’ll correctly get a 404 - because the company doesn’t have these.
Are you sure the ones you’re requesting do this? FWIW you can see the difference if you go to the Companies House web search - these companies will have an additional “Registers” tab.
Examples (I just ran these - I use curl here to make the request):
I’m not sure what sanctions lists you’re referring to, but that has nothing to do with Companies House as far as I’m aware - unless you mean “Disqualified officers”? That is part of the API.