There is no point in hashing IP(v4) addresses – there’s not enough of them to prevent reversing the hashes through brute-force. The only way to anonymise IPv4 data is to not store it. Which makes a real mess of pretty much every anti-abuse measure in existence (not just in Discourse – when the only non-spoofable information is L3/L4, to decide whether or not something is abuse, what else are you going to key off, other than source IP address?)
How so? Do EU residents not travel outside the EU? Or does the GDPR not apply to EU residents when they’re not accessing the Internet via an IP address which is identified as being within the EU? That seems… unlikely.