with enough luck and resources you can isolate it down to a single person. from there "what's the worst that could happen" depends heavily on what past actions you've done on that IP address and/or how motivated and competent your attackers are. so probably absolute worst case scenario is they manage to botnet you and use your computer to store and distribute CP. followed by you being arrested and made a non-person by everyone in your life and getting thrown in jail with by prisoners who torture 'child molesters and pedophiles' for fun as a way to try to salvage some modicum of self-respect for themselves so they can pretend they still have some semblance of morality.
so yeah that's pretty much the worst that could happen. use a vpn and tor.