I know very little about cybersecurity, but my understand of TOR is that a node host wouldn't be able to offer much about the traffic coming across their server(s). The packages are encrypted and there is no entry or destination info, so he may be able to say how much traffic was coming across, but what else could he possibly know? Info on other nodes?

the Bureau can't see the traffic but they have keyloggers on all of his systems. He tried bypassing them with Spice but failed and otherwise got logged getting onto Tor and searching for dubious things