How do I know which IP exclusions are safe to remove?

Google gives you nothing to work from. Blocked clicks never happen, so they generate no data, and an entry that still stops daily attempts looks identical to one that has been dead for a year. The only reliable fix is keeping your own record outside the platform with the date and reason for each exclusion, then pruning oldest and least justified first.