Lawful purposes and legitimate interests are in article 6 of GDPR.
Recital 49 talks about usage of data for network and information security.
Recital 47 mentions fraud prevention and direct marketing as a legitimate interest. Deduplicating link clicks and topic views could be considered fraud prevention.
There are no hard storage limits defined. The time you need to keep an IP address in order to deduplicate statistics depends on the granularity of the accumulated statistics.