@pfefferle @tim Found the problem!
The ActivityPub plugin returns JSON regardless of the case of the Accept header. (So application/json and application/JSON will both work.)
However, Tim's RewriteCond is case sensitive, so only the correctly formatted application/json header will trigger the vary fix.
Slapping [NC] at the end of the RewriteCond does the job.