My goal in using Google Analytics is to determine the external traffic on my website. The IP addresses of internal staff are filtered so they are not compiled in the data. The GA account is personally owned only by me and is password protected. However, don't ISPs who dynamically assign IP addresses defeat this filtering?
You really should have a special flag on your program so that your internal staff's accounts never load the analytics script. Either that or always include a special flag in their reported analytics.
On the IP question: it depends. If you are only concerned about hiding the analytics from the work network you will usually get a static IP if you have business class internet. If not, your IP may not be changing that often anyways. You really don't want to be filtering by IP though.
There is no security risk beyond sensitive data being stolen from your analytics. If your IP changes and suddenly your hidden IP is now in use by one of your users there are still no security issues since you shouldn't be (and really can you even?) using GA for security logging.
There is no security risk.
The reason why you wouldn't want IPs of your staff showing up is so that you do not dilute / pollute the data collected.
I'm struggling to see the connection to security here but if I understand correctly you are worried that staff with dynamic IP addresses can bypass your filtering and pollute your reporting data - i.e you won't be able to confidently say that all your traffic on a particular day was from a successful marketing campaign e.t.c.
Sadly there is nothing you can do with this dynamic IP setup besides either getting them to use IPv6 or keeping track of their public IPs to know when they change - obviously this is a lot of work!
There is no security implication unless you were using the IPs for some sort of firewall filtering such as cloudflare for example.