Depends. According to the GDPR for any processing of PII you need consent from the data subject or a reasonable basis why you have to act upon the data (your servers communicating with an IP adress is neccesary for your service to function). Saving the adress isn't, so you need consent or other legislation under which you're required to store it that trumps the GDPR. That's the so-called "overriding legitimate interest". It doesn't mean "interest = money", "data = money" therefore "data retention = overruling legitimate interest".

Keeping leaked data or scraping it from public sources is still problematic since you do nees consent.

If you're approached as a 3rd party by someone with data who sells them to you you are obliged to make sure the data you're given has been aquired with consent. Often times checks aren't in place, and ultimately, if you're given "bad data" by the intermediary you cab always claim they kenw they should've notified you but didn't.

If you're scraping leaks, well, there's no one between you and the data subject who can take the fall. You've knowingly collected "bad data" unilaterally.