How to stop rsyslog from creating weird folders when vCenter logs come in?

Question

I have installed rsyslog on a Fedora 40 server and would like to use this server as a log server in our network.

This was my original rsyslog template configuration (of course I also enabled TCP and UDP modules):
$template PerHostLog,"/var/log/syslog/%HOSTNAME%/%PROGRAMNAME%.log"
if $fromhost-ip startswith '10.' then -?PerHostLog
& STOP

After that I enabled and linked the log server on our vCenter 8 to test whether the forwarding of the logs works. The logs are saved at the configured location (our vcenter host is called srv05tff-vcenter-10) on the log server, but many other folders (which I assume are coming from vCenter too, since it's the only host sending logs currently) are also created:
root@srv76tff-log-10:/var/log/syslog# ll
drwx------. 2 root root 47 3. Okt 11:53 al
drwx------. 2 root root 24 3. Okt 12:24 amples
drwx------. 2 root root 30 3. Okt 13:11 ations
drwx------. 2 root root 24 3. Okt 12:03 ax
**drwx------. 2 root root 4096 3. Okt 12:24 srv05tff-vcenter-01** # the one i want
drwx------. 2 root root 26 3. Okt 12:03 Filter
drwx------. 2 root root 24 3. Okt 12:03 in
drwx------. 2 root root 43 3. Okt 13:11 l
drwx------. 2 root root 26 3. Okt 13:05 les
drwx------. 2 root root 46 3. Okt 12:50 max
drwx------. 2 root root 24 3. Okt 12:03 mean
drwx------. 2 root root 25 3. Okt 12:24 min
drwx------. 2 root root 24 3. Okt 12:14 n
drwx------. 2 root root 19 3. Okt 11:23 nDetails
drwx------. 2 root root 30 3. Okt 13:16 ns
drwx------. 2 root root 30 3. Okt 11:22 ons
drwx------. 2 root root 30 3. Okt 11:58 Operations
drwx------. 2 root root 70 3. Okt 13:31 otal
drwx------. 2 root root 97 3. Okt 14:07 tal
drwx------. 2 root root 22 3. Okt 12:19 tenance
drwx------. 2 root root 30 3. Okt 12:09 tion
drwx------. 2 root root 24 3. Okt 11:43 total
drwx------. 2 root root 23 3. Okt 13:26 ts
drwx------. 2 root root 26 3. Okt 14:07 umSamples

I played around with the configuration of the template to have rsyslog convert any special characters that might be interfering, and tried options such as :clean, :?-unknown:clean and :escape-cc, but none of it helped. I currently have the following configuration, which does not help either:
$template PerHostLog,"/var/log/syslog/%HOSTNAME:clean%/%PROGRAMNAME:replace:([()\\])=_:clean%.log"
if $fromhost-ip startswith '10.' then -?PerHostLog
& STOP

Does anyone know why these folders keep flooding my rsyslog location?