after more work I'm putting in the VT comments, it looks much less likely to be malware and more likely some kind of data carving / file creation issue.

using binwalk, I found data from dozens of files inside this PDF, but not properly encapsulated. most are incomplete.

the cuts happen at aligned offsets (multiples of common block sizes). maybe the file was created with a buggy pipeline? was it "undeleted?" maybe Jerry Lundegaard was responsible for producing the document?