OK, because of how checkboxes fields are stored it is not practicable to copy the values from one set of checkboxes to a different set of checkboxes, even if the options are set up identically apart from the name/slug. (We have an internal ticket to completely rewrite checkboxes fields, but that doesn't help us right now.)
So my thinking was to go back to something closer to the post revisions idea mentioned previously.
Instead of using actual WordPress post revisions (which support neither custom fields nor taxonomies), mimic them and handle the updates manually.
I forget what post type you are working with, but say it is 'project'. Create a 'version' post type as well, and whatever field groups and custom taxonomies you have available to projects, make them available to version posts, too. (When you have this all set up and working, you can uncheck the "show_ui" option for the version post type so that the posts are not shown in the backend.)
The idea is that when a user edits their project with a Form, instead of updating the project a duplicate post of the type version is created with the new values coming from the form submission. It would mirror the project post, and because it is itself a post, it can have custom fields and taxonomies (the same fields and taxonomies as project post, but possibly with different values).
Your site admins can then compare the current project post with the proposed changes shown in the version post, and if they accept them you can effectively do the reverse, and copy over the fields from the version post to overwrite those in the project post, then delete the version post.
It might not be necessary (because the posts would have the same author and each user is allowed only one project post if I understand correctly), but it could make sense to use the relationships API to make a one-to-one connection between the project and version posts that could prove helpful.
I think that would be an optimal way to proceed.
I ran into a number of obstacles trying to get an example of this to work.
My preferred option was to trick the CRED edit forms so that before the form submission was processed we changed the ID of the post being edited from the actual project being edited to a version post we create, so that the original post was untouched, and the Forms code did all the work of taking the form inputs and storing the corresponding post meta and assigning terms as required. Unfortunately that proved impossible.
So, the alternative that I suggest you try and implement would be to adopt a similar approach with the version posts, and use the cred_before_save_data hook to intercept the form submission before the project post fields are updated with the form content.
You will need to unset any field in the $_POST object that you do not want to get updated in the project post (you cannot simply delete $_POST or the form won't work, so you will unset($_POST['post_title']); etc. for each field).
Create a new version post (using wp_insert_post), and then set the post meta and taxonomies based upon the form fields (available in $_POST). Use toolset_connect_posts (https://toolset.com/documentation/customizing-sites-using-php/post-relationships-api/#toolset_connect_posts) to connect the project to the version posts if that seems helpful.
When the form submission is complete you should have your original project post intact, and a duplicate of this as a version post with the fields updated according to the edit form submission.
You'll then have some basis to compare the two and decide whether to accept the changes. If so, you'll run a code snippet to copy the fields from the version post across to the project post, before disconnecting and then deleting the version post.
That is a fair sized undertaking, which wouldn't be so effortful if WordPress revisions supported custom fields and taxonomies.
The alternative is to simply change the post status to Pending Review when the post is edited, which will mean it going offline until it is approved.