If Hawk 5.2.0 standalone edition was installed on top of TRA 5.10.x or 5.11.x, some components like webconsole and httpadater would be installed. Those components bundles old log4j jars(v1.2.x). 
./TIBCO_HOME/tibco/cfgmgmt/hawk/bin/log4j_agent.properties
./tibco/_installInfo/assembly_registry/tpcl_log4j
./tibco/tra/5.11/lib/log4j2Props.jar
./tibco/hawk/5.2/lib/ext/slf4j-log4j12-1.6.4.jar
./tibco/hawk/5.2/lib/ext/log4j-1.2.15.jar
./tibco/hawk/5.2/lib/compat/ant-apache-log4j.jar
./tibco/hawk/5.2/lib/compat/log4j-1.2.15.jar
./tibco/hawk/5.2/lib/compat/slf4j-log4j12-1.5.2.jar
./tibco/hawk/5.2/bin/log4j_agent.properties
./tibco/hawk/5.2/webconsole/tomcat/lib/log4j-1.2.15.jar
./tibco/hawk/5.2/webconsole/tomcat/lib/slf4j-log4j12-1.6.4.jar
./tibco/hawk/5.2/webconsole/tomcat/webapps/hawkwebconsole/WEB-INF/conf/log4j_webconsole.properties
./tibco/hawk/5.2/webconsole/tomcat/webapps/hawkwebconsole/WEB-INF/lib/log4j-1.2.15.jar
./tibco/hawk/5.2/webconsole/tomcat/webapps/hawkwebconsole/WEB-INF/lib/slf4j-log4j12-1.6.4.jar
./tibco/hawk/5.2/adapters/http/WEB-INF/classes/log4j_http_adapter.properties
./tibco/hawk/5.2/adapters/http/WEB-INF/lib/log4j-1.2.15.jar
./tibco/hawk/5.2/adapters/http/WEB-INF/lib/slf4j-log4j12-1.6.4.jar
./tibco/tpcl/5.11/lib/log4j-slf4j-impl-2.17.1.jar
./tibco/tpcl/5.11/lib/slf4j-log4j12-1.7.31.jar
./tibco/tpcl/5.11/lib/log4j-api-2.17.1.jar
./tibco/tpcl/5.11/lib/log4j-core-2.17.1.jar
./tibco/tpcl/5.11/lib/log4j-appserver-2.17.1.jar
./tibco/tpcl/5.11/ant/1.10/lib/ant-apache-log4j.pom
./tibco/tpcl/5.11/ant/1.10/lib/ant-apache-log4j.jar
When you upgrade to TRA 5.11.3, the installer wont touch the jars in those folders. That is expected behavior. Because they are not TRA components, they are part of standalone hawk.
Log4j jars in those folder are used only by that component. That means if you don't use webconsole and httpadapter, those jars wont be loaded by any applications. It should be OK to leave them there. However, some customers may want to get rid of all old log4j jars from the file system. As Hawk 5.2.0 standalone doesn't provide such a service pack, some post installation steps are required to address that.

All.

1. If webconsole and httpadapter are not in use, you can pack webconsole and adapter/httpadapter in tar/zip files and delete thoes two files directly.
2. If you still need a hawk console application for hawkagent management, creating rulebase etc, you can install hawk standalone edition to a different TIBCO HOME or even a different machine. Below are the recommanded versions which included the latest log4j jars v2.17.1.

Hawk 6.2.1 + HF4 or above -> https://support.tibco.com/s/article/TIBCO-Hawk-6-2-1-Hotfix-04-is-now-available
Hawk Redtail 7.1 + HF3 or above -> https://support.tibco.com/s/article/TIBCO-Operational-Intelligence-Hawk-RedTail-7-1-0-Hotfix-03-is-now-available

In the new versions, hawk provides new HawkConsole instead of webconsole. It is tomcat based also, has new good looking GUI, good performance and new features. And new HawkConsole is fully compatible with hawkagent 5.2.0 and all hotfixes. 
Please read the article below for more details:
Installation and configuration:
https://docs.tibco.com/pub/hawk/6.2.1/doc/pdf/TIB_hawk_6.2_installation.pdf?id=6
Chapter 2 TIBCO Hawk Component Configurations -> Hawk Console Configurations | Page 66

User guide:
https://docs.tibco.com/pub/hawk/6.2.1/doc/pdf/TIB_hawk_6.2_console_users_guide.pdf?id=9

Please feel free to contact TIBCO Support if you have any further issues. We will be more than happy to help you there.

This article is specific to the customer who has standalone hawk 5.2 installed along with TRA 5.10.x or 5.11.x in the same tibco home. For the customers who doesn't have Hawk standalone 5.2, please feel free to ignore.