If you want this to be robust you’d need to provide context around what you expect the response to be. Will it always have 3 groups? Will the value you want always be in the second position? Etc.
Paste this is the template editor in developer tools and play around with it
{% set text = '(cf.tls_client_auth.cert_verified) or (ip.src eq fe82::e0xb:3xx:fe16:daaa) or (ip.src eq 192.168.177.42)' %}
option using character indexing
{{ text[48:74] }}
option using split with keywords and replace
{{ text.split(' or ').1.split(' eq ').1.replace(')','')}}
option using regex
{{ text | regex_findall_index(find='[0-9a-fx]{4}::[0-9a-fx:]{10,20}', index=0) }}