I don't know for sure what the standard actually is without reading it (and those things are a pain to read.)

I really just assume that the = is a reserved character and that it is probably a technical no-no to use it unescaped in the query string value like this.  I am pretty sure that every URI escape utility I've ever used escapes the =, so that is pretty decent evidence that it is probably a good idea.

I agree with you @jgehrett, but this is not a battle I have strong enough opinions on to fight.
(If it were our code generating a URI for calling to another site, I would be all up in arms that we aren't escaping it, but for incoming requests, if we can handle it, I'm copacetic.)