My server is running an AiController for a pawn which the client is never supposed to see. Both are non-replicated.
The server runs a non-replicated SpawnActorFromClass node, and the created pawn runs Spawn Default Controller. This act alone replicates the pawn to the clients. bReplicates is never turned on.
When clients log in to the server, the AiControllers will replicate a pawn down to the clients for each pawn on the server! These replicated pawns are like ghosts, they do not perform Beginplay logic, and they cannot be destroyed on the client nor referenced by the server.