FWIW, there was another syslog process running at the OS level on the device that must have been configured a while back to point to my main Orion server. It wasn't "standard Forescout" and was outside the GUI interface, so it took their support folks a while to weed it out.
Thanks for the help in proving it wasn't doing what we wanted.