And this is why IP addresses are often considered personally identifiable information under the GDPR, as impractical as that makes things like anti-spam/anti-bot.
GDPR requires a lawful basis for collecting and processing PII and one of possible lawful interest is "legitimate interests" that reasonable anti-spam/bot systems would fall under, i.e. ones that don't needlessly store the IP forever and don't use it for other purposes than security.
One of the rare cases where a vpn actually does help. Though of course only if they don't also turn over records.
I thought everyone knew that hiding your IP address from the government was a big reason to use trustworthy VPNs.