One thing I wonder about is what you would do if, say, you have an abuser on your site that you need to ban due to behavior detected after the fact through a log file.
If one needs their IP in order to ban them, but their IP is anonymized, what do you do?
If you store anything else about the user (their firstname/lastname) and can make a relation between this and the IP (e.g. you can see that this IP went to the page myprofile.php?id=438098 at 23:10 yesterday), then you should already have somewhere where the user can see why you store their firstname/lastname. Just add "IP" to the list of data stored, for the purpose of maintaining your systems safe and accessible, warn that you'll store it for 30 days, because after the logs are purged, and then you're fine.
In GDPR terms, we have obvious legitimate interests in being able to identify repeat offenders trying to abuse our system in some way, in being able to identify recurring problems with how our systems are operating, and in tracking long term usage patterns. These interests combined with the very low risk of any adverse consequences should any of the relevant logs leak make our policy of indefinite retention in this specific instance compatible with GDPR in our view.
Incidentally, we have in fact identified repeat abusers returning to our site several years later based on their access patterns and IP addresses as recorded in logs, so there is even an objectively demonstrable long-term threat should anyone ever want to question this policy.
I work in gambling industry, and we are required by the regulations to keep ALL user information, including the KYC documents they submit, on file for a minimum of 5 years after their last activity. If you are looking for toxic data stores, this is among the worst ones there is. Limiting access to that data is crucial, and making sure it's not misused is mandatory.
It could be worse. There are domains with more demanding data retention requirements: insurance and consumer finance in particular.