Ok, the next thing to try is disable the site setting activity pub require signed requests. Let me know when you’ve done that (just thinking out loud I think I’ll turn this subject of “I’m getting 403s” into a wiki as I can see it coming up a fair bit).
Also, which plugin? And how does it work?