They claim that, but the page they link to as the source says "You must...Receive users’ consent before you use any cookies except strictly necessary cookies.". So what exactly makes them think that first-party analytics cookies are "strictly necessary"? The Mastodon link in the at the start of page doesn't seem to work.
https://www.edpb.europa.eu/concernant-le-cepd/mentions-legal...
now of course if it gets joined with other data it can become PII.
IP address is usually treated as PII, because it can have very high "selectivity" (and with a subpoena can be turned into PII, whereas a site specific cryptorandom cookie id cannot)
Session auth cookies are the only ones the EU considers strictly necessary.
There are several others which are permissible. The EU has six examples.
https://commission.europa.eu/resources/europa-web-guide/desi...
The text on that website does state that some DPAs have found some first-party analytics acceptable, but that's not something that is confirmed by CJEU. And ePD does not have single-stop shop so you need to follow every DPAs directions if you are offering services to that DPA's country.