Can a flashed rom leave behind artifacts? I found a few "unofficial" Lollipop ROMS floating around the internet.

I don't know how reliable are they, or how many viruses are there.

All I want to do is to play with it a little. I'm thinking of making an NANDROID backup, flashing the rom, playing with it a little (with no private information placed there), and restoring the NANDROID. 

Is this safe? Can a malicious Rom writer intercept any attempt to flash a Recovery and keep itself on the phone (sort of like a rootkit)?
No, it can't.

As long as you don't flash any new firmware files (like we have to do with the HTC One M8 to get it on lollipop) you should be fine with a nandroid backup.

Long story short, if you only flash via recovery and not via fastboot etc. you should be fine.