In the case of Cloudflare, I don't know how they usually handle this data. But I also don't see them keeping logs from thousands of sites for the rest of their lives.

When someone uploads an image, the IP is recorded. You can use Tor, VPN, DNS or any other similar resource to influence this record. This resource has the sole objective of being able to ban any abuse that occurs. But, honestly, given these events, this becomes the least of my problems, so I will most likely be able to create a system so that this data can be eliminated from the BD.