Thanks for your reply, which might be helpful because we had some old code similar to yours in some CFCs which maybe got called once a week…
<cfset esapi = CreateObject("java", "org.owasp.esapi.ESAPI")>
Luckily we are able to get rid of this code and will see what happens.