For HTTP/web server logs: goaccess using the free db-ip database will give you country-level geolocation info.
For other connections (SSH etc.), setup a Graylog instance, send all your logs to it using rsyslog over TLS, setup pipelines to extract IP addresses from the messages, and setup the GeoIP plugin (graylog.org/…/how-to-set-up-graylog-geoip-configu…). It’s not a small task though. My ansible roles for goaccess and graylog.