I think it is a big issue to use anything containing PII in anything else than production environment. For example, do your QA logs have the same kind of manage

I think it is a big issue to use anything containing PII in anything else than production environment. For example, do your QA logs have the same kind of management, access control and lifetime than production ? If they don't, you might end up logging PII in a way you should not, and could even be in legal troubles for things like GDPR.