Here is what I've done on an older CAS with maven. The exclude is added to maven-war-plugin configuration overlays. Doing it for gradle "war {" should be similar...
--- pom.xml
+++ pom.xml
@@ -59,6 +59,7 @@
<exclude>WEB-INF/lib/log4j-web-2.12.1.jar</exclude>
<exclude>WEB-INF/lib/log4j-jcl-2.12.1.jar</exclude>
<exclude>WEB-INF/lib/log4j-slf4j-impl-2.12.1.jar</exclude>
+ <exclude>WEB-INF/lib/tomcat-*-8.5.45.jar</exclude>
</excludes>
</overlay>
</overlays>
@@ -312,6 +313,17 @@
<version>2.3.2</version>
</dependency>
+ <dependency>
+ <groupId>org.apache.tomcat.embed</groupId>
+ <artifactId>tomcat-embed-jasper</artifactId>
+ <version>8.5.75</version>
+ </dependency>
+ <dependency>
+ <groupId>org.apache.tomcat</groupId>
+ <artifactId>tomcat-catalina-ha</artifactId>
+ <version>8.5.75</version>
+ </dependency>
+
</dependencies>
</profile>