ActivityPub isn’t anything more than JSON over HTTP(s); there’s no reason at all that you couldn’t simply tunnel all the traffic using hidden services over Tor using nothing more than the Tor daemon to create a hidden service and the proxy functionality to route all outbound HTTP traffic over Tor.