Correct. The intent for keeping IP addresses in logs also matters. To give two examples: if you're keeping logs for legal reasons, then it is perfectly fine. I

Correct. The intent for keeping IP addresses in logs also matters. To give two examples: if you're keeping logs for legal reasons, then it is perfectly fine. If you're keeping for anti-fraud reasons, this is also fine and can be considered "legitimate interest" (as long as the amount of time for storage is reasonable, as you said). If you intend to use this data for other reasons, then you need consent before doing so.