I don’t know. It depends on your jurisdiction. However this is an automated tool and most detected images will be false positives. Requirements for reporting are necessary for validated CSAM but IANAL.
The IP is not visible from the object storage. I do store the OS path, so one would need to trace that to the pict-rs ID, and from the to the lemmy post id, and from there to the user.