Sorry to answer my own question...
This issue seems to be resolved when bundling the EJB JAR and WAR into an EAR. The EAR also contains all my support JARs (including my log4j.jar) which are still referenced from the manifest files of my other EJB JAR etc. The WAR file still contains a WEB-INF/lib containing its copy of the support JARs.
The EAR is deployed into jboss/deploy with no other files needed during deployment. It also works with security turned on.
I have tested this on versions 2.2/2.4.0/2.4.1