if (_allowances[from][to] < value) {
            revert ERC20InsufficientAllowance(to, _allowances[from][to], value); //error
        }

        _spendAllowance(from, to, value);

Here you are using to as spender, but the spender is actually msg.sender.