Oh, it could be because spread is calculated independently on both server and client using the same random seed, so you'll need to have the same script on the client as you do on the server for the bullet spread to match up on both. Sorry for not thinking of this sooner, it's actually been a long time since I messed with the weapon scripts and spread code.
But actually this is kind of interesting. ROF should suffer from the same issues, and bug out pretty hard if there's a difference in the file between client and server. It might be worth putting ge_bot into console and checking how many shots are actually connecting, because what you see on the client isn't what's happening on the server if the script files are different. I hate to say it but it's going to make custom weapon servers pretty hard to run. Damage values and other stuff only relevant to the server can be seamlessly changed, but what you want is more spread and clients expect the server to match their values for that.
It's still possible to distribute new weapon files to all the clients who want to play on such a server, but please only do that with friends or people who know what they're getting into since they'll have issues playing on any other server unless they change their files back.