> How can we be required to delete IP addresses in our logs yet also be required to keep access audit logs for 7 years.

I don't know where you got this idea, but I strongly suggest you find someone who has experience with the GDPR and discuss this with them. These two things are not even remotely close to any grey areas that could land someone in hot water.