I believe that you want to encode your values at the outermost level, so #esapiEncoder.encodeForHTML(DecimalFormat(hrsTotalLeave))#
would be the way to go.
Using your second example and attempting to use format functions on encoded strings will potentially lead to issues as well.