Does electrum writes logs which may contain the IP of the rogue electrumx server?
not exactly but there is a file called "recent_servers" where it stores 10-20 servers that you recently connected to. note that connection is for receiving block headers (from multiple servers) and sending transactions. you have to go through that list to see if you can find the malicious server.
this file is located in same place as your wallet files. under windows it is:
C:\Users\{username}\AppData\Roaming\Electrum
open it with a text editor like notepad. and try not to edit/change anything in the files you see in these directories!