We figured out the problem -- we had two Tomcat web contexts pointing to the same file path. This effectively created duplicates of everything in our system, including two Log4J loggers pointing to the same log file. So it was a configuration error on our part, not a programming error in Log4j
Unfortunately, we found this out just by analyzing our configuration -- we didn't find a tool that gave use more information than Process Explorer. We didn't try WhoLockMe because we couldn't install something like that on the machine where the problem was occurring, and we couldn't reproduce the error on other machines.