Log4j 2.12.4, which is used in the Elastic APM Java Agent 1.28.4 addresses these vulnerabilities.
See also Apache Log4j2 Remote Code Execution (RCE) Vulnerability - CVE-2021-44228 - ESA-2021-31 and Log4j – Apache Log4j Security Vulnerabilities.
If your vulnerability scanner doesn't detect that Log4j 2.12.4/Elastic APM Java Agent 1.28.4 contains fixes to these CVEs, please get in touch with the vendor of this scanner so that they can update their policies.