If the mod log is public, then it does make sense for there to be a "public" and "private" version, so perhaps allowing an edit of a modlog entry will change the view presented to federation and non-admins, while the original view stays immutable? This could allow the modlog to stay public.
The option to have the modlog visibility be either public | signed in | admin only is a good option as well, and a good combination for those who are concerned about doxing could be "signed in + modified view" or going straight to admin only. Another consideration could be to have the text body be admin only, but still present the mod log of username + action + reason, but without the details?
So, it could be the simplest option may be to have a flag to show details to admins only, and to not include the text in federation or to federate "details available to instance admins only" or something like that. This could be the least amount of work, possibly.