While there continue to be new CVEs related to log4j, I believe they don't affect us unless an attacker has filesystem access to the configuration files.

That said, it's worth keeping up just to eliminate any possible issues that upstream has solved in these patches.