Is a padding oracle attack possible if data is only encrypted internally on a server (e.g. for storage)?
As far as I can tell, you just have encrypted data in a DB and are worrying that it can be hacked. In short, encryption works so you're good.

In more detail, your analysis of a padding oracle attack is correct. As you don't have any services or APIs or network protocols that partake in the encryption, a padding oracle attack can't occur. 

Understanding that I don't fully understand your architecture, I can tell you about the attacks I'd worry about:


There are potential client-side attacks. Perhaps via OS or browser malware. Not your app's fault but can still lead to an exposure of your data.
If you have a malicious admin, they could attack your application directly. They could potentially modify your class files to extract your data while it's in motion. Worse, they can call your decryption functions to bulk decrypt the DB.
Examination of your app's memory to look for secure data or the encryption key.
Examination of your app's configuration to get your decryption key. 
An application vulnerability that allows a remote attacker to extract data from your app or cause it to perform malicious actions. This may be the biggest threat as it allows for remote attacks.


I'm sure there's more but that's my quick evaluation. I think that the breaking the DB encryption is far down the list of things to worry about. Secure your key (preferably in a password-sealed keystore) and secure your app against a remote attack.