IPs can be PII under certain circumstances, but not the ones I laid out.

> Purpose of security doesn't change if its PII or not.

Security is the legitimate interest, an important part of collection under GDPR.