That's not true. One of the bases for legal processing is legitimate interest, as long as it doesn't override data subject's legitimate interest or fundamental

That's not true. One of the bases for legal processing is legitimate interest, as long as it doesn't override data subject's legitimate interest or fundamental rights and freedoms. You can use the IP address for support, or for keeping track of bans, but you have to inform the user about it, keep the minimal amount of information you can, have a retention policy in place, restrict access to these logs to only people who legitimately need them. If you don't provide support then you don't need the data.