>How can we be required to delete IP addresses in our logs yet also be required to keep access audit logs for 7 years.

Then you may well be able to rely on the Legal Obligation basis for processing, namely that “processing is necessary for compliance with a legal obligation to which the controller is subject.”