I want to start by apologizing for my delay in getting back to you on this. Based on the XML that you have provided, I can see a few potential issues:
1. You have a single contact list ID that begins with https:// while the format for the ID URIs is to begin with http://
2. Your StateCode field element contains the word State rather than a valid two-character state code (Such as MA)
2a. Your StateName field should contain the matching full name of the state specified in the StateCode field (Such as Massachusetts)
3. You have specified the same lists (3,8,21) twice in your request. They should only listed once per unique list ID.
Hopefully this is enough information to help you get this issue sorted out. If these items do not provide enough information to get this request working, you will want to make sure that you capture the HTTP Response text when you receive a 400 error. This response text will contain an error message describing what the problem is and may provide enough information to correct the problem.