Geolocation can be done without a subprocessor. It goes against the grain of outsourcing everything under the sun but all you need is a high-quality local database of IP address ranges.

And yeah, by all means, include that in your privacy policy.

I don't know details of the GDPR (as the don't apply to me) but a logged IP address belonging to the original requestor seems odd, do you also own the footprints you physically left behind on the ground as you walk around?