First of all, I wouldn't advise you to forward form data via the API unless you have a complete and well-thought-out rate-limiting mechanism in place. If you consume one API call for every public form post, it's trivial for someone to use up all of your API calls for the day in about 1/2 hour.
If you don't program defensively and with the stability of your other integrations in mind, you'll end up with a gaping DoS vulnerability in the course of adding validation -- a net loss and a risk that a professional business can't take.
The native Marketo forms endpoint can accept 43,200 form posts per day, per source IP, providing adequate protection against DoS attacks while still servicing real-world traffic. Your solution, on the other hand, cannot possibly service more than 50,000 form posts per day, total -- and far less than that if you're using other integrations -- an infinitesimal fraction of the capacity of the true forms endpoint. So you must carefully manage those 50,000 (or less) calls to ensure, as much as possible, that they are allocated for legitimate use. This is not something you turn out overnight by merely checking values and forwarding them to Marketo via API.
With the API, there is no supported way to create a Filled Out Form activity in the Marketo Activity Log. Those activities only happen via a client-side Marketo form; reverse-engineering the forms endpoint for server-side use is no longer supported. You don't need a Custom Activity, either. Instead, call the REST API Push Lead method to get fairly close to a Filled Out Form. Though missing some forms functionality, it will likely be fine for your case.
You might also consider signing Marketo form payloads using your outside validation service, then passing the signed form data through the standard client-side Marketo form. You then call a webhook on the Marketo server side to check the signature and accept the data if it's valid. You don't write directly to primary fields (write the unvalidated form data to proxy field(s)), and you block field updates, so no unvalidated data will enter your primary fields.
.png)