The preflight module is the only module using log4j (version 1).
It could be a good idea to remove it. There are really few uses of it in the product and it looks not used in a good way. It will be easy to remove.
On the other hand, we can discuss on the opportunity to use a logger implementation in pdfbox. IMO, we should not use a logger in the core pdfbox as it is a technical API. Maybe it could be used in top level elements of pdfbox (examples, main...).
Please vote and comment.