Looking at, for example, https://repo1.maven.org/maven2/org/apache/flink/flink-python_2.11/1.13.0/ the jar file contains three LGPL-2.1 source files:
There's nothing in the DEPENDENCIES or licenses directory on the topic. It looks like Netty brings in the LGPL-2.1 JBoss dependency (depending on the Apache-2.0 JBoss Marshalling, which depends on the LGPL-2.1 JBoss Modules).
The xsd files are also appear to be coming from JBoss Modules. Given Apache's position on LGPL-2.1 dependency inclusion in ASF projects, this seems like an issue.