Instead of chef-client allowing the role attributes for the ntp servers in the ntp-server role to replace the attributes in the base (or environment file) it instead uses both sets of attributes - the two attributes of differing precedence get concatenated.
According to the example it is possible to specific the internal ntp servers in a role such as base, and supply the ntp servers' upstream external time sources in a separate role.
It seems this problem is not unique: https://tickets.opscode.com/browse/CHEF-2780
This seems to be quite an obvious problem though that would affect everyone on Chef 11+ so perhaps I am doing something wrong.