Not regular expressions, though SQL LIKE expressions.  However there shouldn't be a security risk in passing them through; the worst that should happen is that extra results might be returned.

Without changing the activityLogPrivate API, there's no way to implement full substring matches (there's no escape character available for "%") so options here are limited.