You still need consent for that, as you processed the IP for that purpose and it is explicitly never allowed under other legal bases.

Again, this is a completely settled matter in the EU, so you can easily look it up if your don't believe me.

Cool, then ignore the ip and just consider the amount of requests to a given endpoint. Counting that should be sufficient