The TL;DR version: Every certificate goes into the log. *.example.com going into the log is no problem for hiding a particular subdomain.
Apparently, the intended scenario would be a subdomain which is public accessible but the owner wishes to keep secret, so their concern is actually just the domain existing in CT logs (I am aware that it makes zero sense).