Risks hashing salt + 5 - 8 number pin with PBKDF2
Yes, look for example here. Consider using Argon2 for instance.
Yes, your concerns are valid. Password derivation should be slow enough. But in practice users cannot accept if login takes  longer than 1 sec. So the password derivation should take not longer than 1 sec. If a PIN consists of 5 digits, it means 100 000 different PINs. If every one takes no longer than 1 sec, an attacker needs not more than 100 000 sec to brute force it with a single core of CPU, means ~28 hours. In case of 4 core CPU it will take ~7 hours. With 8 digit PINs it will take longer. Roughly it can be about 28000 hours for single core CPU = 7000 hours for 4 core CPU = 292 days for such CPU. Means, if you have 10 CPUs, it will take less than 1 month to break it. With more CPUs the brute forcing will take even less time.
The question about auditing is out of scope on this site. Better is to ask it at Information Security site. But no matter what auditing you will implement, if an attacker obtains database with password hashes, he will brute force it, retrieve plain passwords, and then apply them. When some user complains that something is wrong with his account, auditing might help to track the attacker. But it can be that even finding the attacker will not help to mitigate the damage caused.