Thanks, that's very interesting! I wasn't aware that IP address is considered personal data under GDPR... That seems exploitable...
In what way are you thinking IP address as PII is exploitable?
My first thought is that you could impersonate a person by spoofing their IP address. PII identifies a person but I don't think anyone is advocating for (solely) IP-address based bank logins.
You can disable the tracking parts in Piwik, or you can assume a legal stance under one of the 6 exceptions like "Legitimate interests" (https://matomo.org/blog/2018/04/lawful-basis-for-processing-...).