The point is: the regulator simply can't prosecute every website, even if he wanted to. The regulator's goal is to achieve compliance. Accordingly, the regulator will first warn you that your site appears to be non-compliant. He will advise you on steps to be taken to come into compliance.

Regarding Apache logs, a default install of logrotate will probably bring you into compliance (not sure, haven't looked into it lately). Scrubbing IP addresses from Apache logs defeats the purpose of the logs; you need to know what IP addresses are attacking your server.

To reach the stage of a modest fine, you will have to ignore that warning and advice, effectively saying "So fine me, regulator!" And if your violation isn't egregious, you'll be a long way down the list of forthcoming legal actions.

Basically, making a reasonable effort to understand GDPR and come into compliance is probably both a protection against action, and a defence against conviction.

It's not hard to comply with the GDPR, unless you are running a business that depends on violating GDPR.

IANAL.