You are correct in your understanding that IP addresses are considered personal data under GDPR because they relate to an identifiable natural person (data subject), even if you don't store/process sufficient information to identify the individual yourselves. The definition can be found in Article 4(1) under the heading 'Definitions':
"'personal data' means any information relating to an identified natural person ('data subject'); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;"
(GDPR Article 4(1): Definitions, p.33)
If any of your hosting customers are located within the EU or do business in the EU then as a data processor to them you will need a contract in place with the data controller, or the processor on who's behalf you are essentially sub-processing (your customer or hosting account holder):
"3. Processsing by a processor shall be governed by a contract or other legal act under Union or Member State law, that is binding on the processor with regard to the controller and that sets out the subject-matter and duration of the processing, the nature and purpose of the processing, the type of personal data and categories of data subjects and the obligations and rights of the controller. That contract or other legal act shall stipulate, in particular, that the processor: ..."
(GDPR Article 28(3): Processor, p.49)
Article 28(3) then continues to list out what must be covered within the contract.
Essentially, whilst the processing may be considered minimalistic, low-risk, and perhaps only complying with other statutory obligations, you will still need to ensure you have compliance documentation for GDPR if your organisation and/or infrastructure falls within its scope, and contracts may need to be implemented or updated where they don't currently satisfy Article 28(3).
Specifically with regard to the log data itself (e.g. Apache access/error logs), it sounds like you may be the Data Controller and therefore may need to register with the appropriate supervisory authority, though this is for you to decide - if you choose you are a processor regarding this data, then the controllers need to be kept informed of all processing so they can demonstrate their compliance.
Whether processor or controller, provided you are strict in that the log data is not used for any other purposes (analytics etc), then since the information is recorded and kept solely for information security purposes then in your GDPR documentation's 'Information Asset Register' you would state that with regards to the lawfulness of processing of the log data, it is processed for the purpose of a legitimate interest, network and information security:
"(f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party,
except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject
which require protection of personal data, in particular where the data subject is a child."
(GDPR Article 6(f): Lawfulness of Processing, p.36)
Where this legitimate interest is defined in Recital 49:
"The processing of personal data to the extent strictly necessary and proportionate for the purposes of ensuring network and information security, i.e. the ability of a network or an information system to resist, at a given level of confidence, accidental events or unlawful or malicious actions that compromise the availability, authenticity, integrity and confidentiality of stored or transmitted personal data, and the security of the related services offered by, or accessible via, those networks and systems, by public authorities, by computer emergency response teams (CERTs), computer security incident response teams (CSIRTs), by providers of electronic communications
networks and services and by providers of security technologies and services, constitutes a legitimate interest of the data controller concerned. This could, for example, include preventing unauthorised access to electronic communications networks and malicious code distribution and stopping ‘denial of service’ attacks and damage to computer and electronic communication systems." (GDPR Recital 49, p.9)
Under Article 32(1) you would still be responsible for keeping these logs secure, and need to be able to demonstrate your compliance with this:
"Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, the controller and the processor shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including inter alia as appropriate:" (GDPR Article 32(1), p.52)
It goes on to detail appropriate measures to take such as encryption. Log information that gets archived/backed-up should be encrypted, and you will need to delete old archived logs once they reach the end of the retention period you have decided upon (e.g. 1 year). There needs to be sufficient length of retention for them to be available to support investigations when required.
With regards to the new 'right to erasure (right to be forgotten)' introduced with GDPR in Article 17, you do not need to delete security log information in response to a request to delete personal data, since otherwise the system attackers would ask you to delete the evidence of their activity prior to an investigation being launched!
"Paragraphs 1 and 2 shall not apply to the extent that processing is necessary: [...] (e) for the establishment, exercise or defence of legal claims." (GDPR Article 17(3)(e), p.44)
Provided you have already taken care of the appropriate technical and organisational controls, this is probably going to simply be a documentation exercise for you to make sure you have the appropriate paperwork to be able to demonstrate compliance, but you will need to get your contracts updated with your hosting customers so that they are aware of what data is processed for what purposes etc, so that they can ensure their own contracts with their own customers/users (the data controllers) are comprehensive in including all sub-processing that takes place.
