How can we centralize CloudTrail logs across existing AWS accounts?

If the accounts are in AWS Organizations, look at an organization trail that delivers to an S3 bucket in a central logging account. You can query the logs in that bucket with Athena without first loading them into a separate search service.

Check the organization trail settings against what your existing trails capture before changing anything. An organization trail helps with collection going forward, but it does not automatically put your older logs into the central bucket.

Another route is to keep the existing trails and centralize their S3 logs. Cross-account S3 replication can send objects to a bucket in a logging account, which you can then use as the source for a search or monitoring service.

Check what historical objects are covered by the replication configuration. Don't assume that enabling it today automatically moves everything already in the source buckets.

Central storage solves the account-hopping problem, but decide how you want to investigate too. Athena is useful for querying S3 logs, while CloudWatch Logs or a separate search service may fit if you want a different way to search and analyze events.

Try a cross-account role investigation as a test case. You still need to connect the role assumption with activity under the assumed role, even when all the events are in one place.

For the history question, start by checking what logs are still retained in each account and how far back you need to search. Centralizing new events won't fill gaps where older logs are no longer available.

If a full migration is too much work, you could centralize the retained period you need most and document how to retrieve anything older that remains in the original accounts.