Shifting the position of the hyphen from the end to between the exclamation mark and greater than sign can have a significant impact. If the hyphen is not the first or last character specified within the character class, it creates a range like 'a-b' that matches all characters with code points between those of 'a' and 'b'.
The Unicode code point for the exclamation mark is U+0021, while the code point for the greater than sign is U+003E. This range includes various characters, such as digits (with code points from U+0030 to U+0039) - a detailed list can be found here. Consequently, the character class ends up matching the digits too.
To resolve this issue, either keep the hyphen at the end of the character class (as in the initial example) or escape it using a backslash to interpret it as a literal character:
alert(' test £32 <!-- -->'.replace(/^\s+|[ <!\->]+$/g,''));