Are the logs permanent? If not then GDPR doesn't cover it. Can you use the logs to identify users and their behaviour? If not GDPR doesn't cover it.
If you keep permanent logs with information about users, then yeah that is a problem. But it should be a problem, that is a big potential security/privacy issue.