Your test dependencies may have transitive dependencies on different versions log4j or you may have different version constraints for test dependencies. There are several strategies to prevent vulnerabilities in your build outlined in this blog post:
https://blog.gradle.org/log4j-vulnerability
In the future, this is a good question for
#CAH4ZP3GX.