Legally, in EU, you probably cannot scrape an instance of someone else because of the database copyright law. But I have no idea if that applies to being part of the network. Since the other instances send you their content willingly.
Maybe someone should make a license extension to ActivityPub, where instances can communicate what can and what can't be done with the information they publish. Then at least there would be legal clarity. If it can be enforced is another question.