As for GDPR compliance, users are in full control of their data. You can delete anything you want from the system. We do collect some anonymous aggregates statistics from servers, but that can easily be disabled in the configuration.
Do you have a whitepaper describing your aggregation methods? I've seen a talk by some Google engineers who worked on Maps and they went to extensive efforts to anonymize drive segments. This is very difficult (there's a surprising amount of subtlety) and while I'm not doubting your company's abilities, publishing such a whitepaper would help dispel any misgivings people might get over knowing that you collect this by default.
https://github.com/traccar/traccar/blob/master/src/main/java...
I've seen other open source apps that does that by default as well. Open source just means the source is open and that is all.