Ok, we’ve found the issue 
Your requests are being blocked by the domain allow / deny lists. So you’ve either:
- entered domains in the
activity pub allowed request originslist. This means requests from all other domains will be blocked; or - there is a bug with this code.
Please share exactly what you have in both the activity_pub_allowed_request_origins and activity_pub_blocked_request_origins settings.