A web access-log records (ts, ip, request, ...), or maybe your application log stores (ts, ip, action, params, ...)
So the information from that single source is "at time T, IP accessed RESOURCE".
It's possible that's personally identifiable in context (if you have additional controls that RESOURCE can only be accessed by exactly 1 real person, etc)
But say it's not. All you know is: Opaque PERSON accessed RESOURCE.
if you can obtain the identifying information from elsewhere (buy, steal, etc) from ISP or whatever, you now know that (T, IP) = NAMEDPERSON.
A simple lookup/matching means you know that NAMEDPERSON accessed RESOURCE. That's the new personal data.
The IP isn't irrelevant, because without it, you'd have no lookup key to determine the mapping from PERSON? to NAMEDPERSON.