does log4j2 has JNDI risk if you alway format your log

The vulnerability is triggered by the formatted log message, so it does not matter whether you create the message through string concatenation, by using the parameterized logging methods (as in your example) or in any other way.
So yes, your code is most likely vulnerable.

You can easily test this by running:

String user = "${java:os}";
logger.info("User '{}' logged in", user);

Note however that you should not consider your application safe in case the lookup placeholder in the log message above is not substituted. It also depends on which logging layout you use.

To be safe you should either way update the Log4j 2 version used by your application or try the other mitigations listed in the security notes.