Earlier quoted context omitted.
I guess you still need to manage accounts ? Also under GDPR IP address retention can fall under that in your logs depending on how you manage the info, same way analytics would need attention. It should really be more simple, and I wish we'd have more people just building small sites here and there without having to care much about these details.
If you require logins you don't need to store the IP address for preventing abuse. The user gives you the identifier on login. The IP is a quite bad id anyways since it changes alot.
It gets messy when you have a number of users and need to know why a specific user is sending you 150 requests per min for 3 hours: you'll insta ban that user, but still need to understand what happened. Did they get their login info leak and the whole internet is having a field day with it ? Is it an issue with your system and their browser is stuck in a weird loop ? Are you session management backend going bust and they're actually all different logged users ?
You'll only know if you have the IP, parts of the headers and some more debugging info, and activating the debug after the fact is often not good enough.