It took a while to figure out what was going on, but this was it:
Since some text was too long to fit on one line, VaultWiki was applying word-wrapping to it on the server side. Apparently there is a bug in vBulletin's word wrap function (it is not UTF-8 safe), so it would sometimes add a space in the middle of a multi-byte character. In some cases, this would create 1 or 2 characters that don't actually exist in UTF-8. Chrome responded to this by interpreting the non-existent characters as ?. Firefox and IE responded to this by not being able to decode the AJAX response at all.
While this is due to a bug in vBulletin's word-wrap function, I have implemented a workaround by overriding the vBulletin function wherever VaultWiki wants a word wrapped.
Marked as fixed in the next release.
Please note that this issue would apply to anywhere where a word-wrapping function is used, not just in the Recent Activity block. Wherever word wrapping applies to text in an AJAX response (like editing a post, or using quick reply), you run the risk of getting an empty response back in Firefox and IE. This would be from the bug in vBulletin, and VaultWiki can't fix it.