Dealing with implementation complexity
You've touched on several points that I could add to, but the core of your concern seems to be this:
As SortByDependency and BuildResultsQuery start to gain complexity, we started to think this is too much responsibility for a repository method.
The spirit is good, but it's being misapplied.
I suspect that your conclusion of needing to avoid complexity fits somewhere where it's trying to adhere to both the (admittedly vague) single responsibility principle and the general advice to not let methods get too long. These are actually two separate points with a different focus.
SRP
SRP does not (directly) care about the complexity of a method body. It cares about the purpose of a method (or class), and that that purpose isn't bundling totally unrelated concerns together.
Indirectly, the SRP argument is that this kind of bundling leads to a complex method body, which you don't want. But the logical inverse isn't true. A method body being complex does not prove that SRP is being violated. Simply put, you can have a complex method body that still only does one thing, which would not be great but not an SRP violation either.
You said:
As SortByDependency and BuildResultsQuery start to gain complexity, we started to think this is too much responsibility for a repository method.
And the key thing I want to point out here is that making a method more complex doesn't necessarily mean that you're actually expanding its responsibilities; it can just as well mean that you're rewriting the same responsibility to be handled a different way.
Avoiding complex method bodies
The general advice on not letting method bodies get too long or comples only cares about this method, not (directly) any submethods that this method might be calling.
So, yes, you are correct that you want to ensure that CreateCustomerResults's method body does not grow to be complex. However, you said:
As SortByDependency and BuildResultsQuery start to gain complexity, we started to think this is too much responsibility for a repository method.
Those are different methods. You could rewrite SortByDependency to be a massively monolithic function, and that would be a bad idea, but it doesn't impact our judgment of what the CreateCustomerResults method looks like since we didn't make a change to CreateCustomerResults.
So what should you do?
You need to distinguish more between what kinds of changes you could be making to this code.
If you are rewriting the same responsibility in a more complex way, then you can safely ignore SRP as it will be maintained (i.e. not violated any further). The only thing you really need to be on the lookout for is that when a given method becomes too complex, it needs to be broken down into smaller pieces. Whether those pieces are private submethods or a new public dependency is contextual. The latter usually suggests that the new complexity is introducing a new kind of responsibility.
If you are introducing a new responsibility, you need to abstract it away into its own thing which your original uses as a dependency. When your original class starts using this new dependency, it might be that this is the straw that breaks the camel's back in terms of method body complexity. If so, refer to the previous paragraph. If not, then no further action is needed.
The right layer for the job
You brought up the layers in your project, because you suspect that you might be able to shift some of this logic into another layer. That is another way in which this can be tackled, but I want to first state something very clearly:
The right layer for the job is defined by what the job is, not how complex the job is.
In order words, what this section is talking about is a decision that you need to make before you tackle the previous section, and decisions made in the previous section should not change the decision you make with regards to what layer you implement it in.
Whether or not the current implementation should live in your persistence layer hinges on one compound question:
Does the domain/application really only care about CustomerResults here, and are the rest of the details merely a persistence implementation detail?
If yes, then all good.
However, I suspect this is not the case. Persistence layers (at least their queries) should really stick to one retrieval, i.e. it really always boils down to "get me the XYZ" (this is not the same as "one database call"!).
You're tying the sourcing of your formulae to the retrieval of the subsequent customer results. I can't definitively judge your business requirements, but it looks to me like these are two separate domain concept.
If I'm right, then the formulae should become an input parameter to this method, and your application logic should be first retrieving the formulae (however it wants to retrieve them), and then subsequently pass those formulae to the method that retrieves the customer results.
We also have doubts with that approach, because we´ll have to read the formulas as entities, map to business, sort and map to entities again.
Unless you are dealing with vast number of items (I'm thinking upwards of 6 digits here), in-memory mapping is a negligible performance cost and should not be driving your design.
Secondly, you might not need to map back from the domain model back to the entity - but this depends on how you're using those formulae in the BuildResultsQuery implementation, which I simply don't know.
However, the main point here is a repeat of what I already pointed out: these concerns do not trump the decision on which layer should be handling which part of the job.
Clean layer separation is not done to squeeze every drop of runtime performance that you could possibly get. Clean layer separation gives you significantly simpler code maintenance costs and significantly increased readability, at the potential cost of having to do a bit of extra runtime legwork to transition from one layer to another.
If you only care about runtime performance above anything else, no matter the cost, then you're not going to be looking favorably at layer separation. However, runtime performance is generally not the main focus, development velocity is (as it defines what developers can achieve for a given budget).
SortByDependencycannot be migrated in to theGET_CUSTOMER_FORMULAS_QUERY? I don't need to know the reason why but my first port of call is wondering why you're sorting in-memory instead of having the DB do it for you.