With the Lemmy developers' help, we figured it out! It was NodeBB's spam protection mechanism. One of our configurable options is to limit the number of upvotes one can make per day.
Someone (or someones) on Lemmy communities was sending lots of upvotes and running into this limitation when those activities were propagated to NodeBB.
NodeBB dutifully noted this and sent back an HTTP 500.
Lemmy dutifully noted this and retried sending the activity using an exponential backoff algorithm
Eventually enough 500s were recorded that Lemmy decided that our server needed a time-out of sorts
I updated the code to handle this case better, and now the activities are coming in at full speed. It'll take awhile to get back up to sync though