Dependency management and exclusion is spread in almost every modules, while they should be specified in one place. With the current build setup, the root pom seems the most logical place (although having a parent that extends from the bom would make more sense).
The build could also use some tidy up in terms of formatting and structure.