It's JNDI itself.  JNDI uses ABANDON requests.  Are you using persistent
search at all?  Another 389 user reported similar problems caused by
improper handling of JNDI persistent searches + ABANDON requests.
Although this looks different, both issues have JNDI and ABANDON in common.

We are not using persistent search at all.  I will try to track down what in our code creates the ABANDON requests but might take me a bit.  Once successfull I'll get you something that causes the ABANDON to show up followed by a startTLS.