It is an "oversight" to include photos of people you know don't exist? Who found those images? Who copied the URLs into the html?

If someone is worried about their PII, why in the world would they pay you to share more of that information with someone who just makes stuff up?

BTW, you don't need and LLM to do this work. ML has had full PII identification support for years.