We have a server setup as follows:
Let me preface my answer by stating that I am still running ColdFusion 9 so I don't have first-hand experience with the 404 handling in ColdFusion 10 with Tomcat. Obviously I will need to upgrade to version 10 so I am trying to familiarize myself with it's nuances (like handling 404's). So I did some searching.
As you stated in your question, with ColdFusion 9 and IIS the originally requested file is normally contained with the CGI.QUERY_STRING variable prepended with "404;". With ColdFusion 10 and Tomcat it appears as though some other CGI variables contain the originally requested file and it depends on your setup which variable that is.
I found this blog post by Raymond Camden - Reminder--there-is-more-to-the-CGI-scope-than-what-the-dump-shows. While that contains good info in itself I also found within the comments by Jules Gravinese the following:
When using IIS7 the variable is CGI.HTTP_X_ORIGINAL_URL
When using ISAPI_rewrite the variable is CGI.HTTP_X_REWRITE_URL
When using APACHE the variable is CGI.REDIRECT_URL
I also found some other articles referencing a CGI.REDIRECT_QUERY_STRING variable which I believe is also included when using APACHE.
Found another article from Adobe regarding the CGI variables and how they are used with ColdFusion (and how/why it is not a complete list): CGI environment (CGI Scope) variables.
NOTE: I also found this bug ColdFusion 10.0 - Bug 3488063: IIS 404 custom error handler URLs that are .cfm files do not consistently return entire document which has been closed but several recent comments suggest that it is still an issue. So be aware of that.