You define @ID2
as nvarchar(10)
in your parameters for the dynamic SQL.
It's actually 14 characters, so you are cutting off the end of it.
This outputs the correct variable for me:
DECLARE @CID nvarchar(10)
SET @CID = '0000000001'
DECLARE @ID2 nvarchar(14)
SET @ID2 = '"*' + @CID + '*"'
DECLARE @SQL nvarchar(200)
SET @SQL = 'SELECT @ID2'
DECLARE @ParamDefinition NCHAR(300)
SET @ParamDefinition = '@ID2 nvarchar(14)'
EXECUTE SP_EXECUTESQL @SQL, @ParamDefinition, @ID2