Lets try the law on this one:

Is the IP personal data for the GDPR? If I read the GDPR, the Debian foundation is not capable to pinpoint 1 person so it seems to me it is not (An ISP or someone receiving an IP to person mapping from them is something different):

  ‘personal data’ means any information relating to an
  identified or identifiable natural person (‘data subject’); 
  an identifiable natural person is one who can be
  identified, directly or indirectly, in particular by   
  reference to an identifier such as a name, an
  identification number, location data, an online identifier 
  or to one or more factors specific to the physical, 
  physiological, genetic, mental, economic, cultural or
  social identity of that natural person;

Furthermore, the Debian foundation has a legitimate interest in monitoring their machines and protecting them against attacks. Logs containing IPs are a common practice, so there is a legal base for processing IPs even if they would be personal data:

  processing is necessary for the purposes of the legitimate
  interests pursued by the controller or by a third party, 
  except where such interests are overridden by the 
  interests or fundamental rights and freedoms of the data 
  subject which require protection of personal data, in 
  particular where the data subject is a child.

All of this assuming they use the IP for apache logs only, and don't send these logs to third parties for data mining or whatever.