Yeah as someone who had to deal with GDPR in a professional capacity, it’s probably better to just assume that content written by users contains PII since you really have no way of telling whether it does or doesn’t.
Naturally you can just ignore that and leave the content as-is, but then you run the risk of some data protection authority ruining your day.
To expand on this, the problem with huge releases is that bugs tend to pile up along with the new features, simply because more stuff has been changed. You’re much more likely to experience a painful release if you pile in months of changes, and this is doubly true for a distributed system with no rigorous testing of the system itself instead of just units