Lawyer here.
Let’s first settle the debate about whether we are dealing with personal data (yes we are).
IP addresses most definitely are personal data (except in some very rare circumstances - all of which are not present here). It is not relevant whether you figure out the data subject’s identity from an IP addresses because you can still use an IP address to single out a data subject.
People often claim that IP-addresses are not personal data because they are not directly identifying. This is simply not true. In Breyer v. Bundesrepublik Deutschland the European Court of Justice ruled that IP addresses are personal data because the IP can be tied to a person via the ISP. It doesn’t matter whether the forum owner (controller) is able to do this, just as long as it is possible IP-addresses will be considered personal data. For example, when you as a forum owner give IP addresses to the police which then obtains the information of the person behind the IP from the ISP through a court order. Furthermore, GDPR itself clarifies in recital 30 that IP addresses are personal data.
Now, from a legal standpoint you could definitely log IP-addresses to some extent. To what extent greatly depends on the specific circumstances but logging for say a month would be pretty reasonable in order to protect against misconduct. Add proper security safeguards, such as pseudonymizing the IP’s by hashing them etc.
There’s this notion that just because something is personal data you are not allowed to process it without consent. This is fundamentally incorrect. The whole purpose of GDPR is to allow for the processing of personal data and it sets out a certain set of rules.