As far as I can determine, from my lay understanding of generic law, there’s no legal objection to removing all the Mastodon branding/theming and installing one’s own, as long as you don’t try to pass the software off as your own.
Adherence to the AGPL 3.0 is the only explicit legal standard that appears to apply.
In practice, I found it a bit of a struggle to replace some of the Mastodon graphics because some of them kept coming back. I then twigged to the purpose of the “packs” and “assets” directories: they get refreshed from the cloud each time you do a compile. The remedy is to put your customized graphics in another directory such as “public” (which is where the favicon and platform icons are already) and change the paths to them in the codebase.
Longer term I’ll have a compliant and complete fork on github.com that incorporates these changes, with a script that is run after installation of the vanilla instance.