Mac Clients getting IP address out of DHCP range when Net Restoring
Despite the Mac server's DHCP service being "off", it might still be handing out addresses to DHCP clients. The DHCP and NetInstall/NetBoot services are both handled by the same daemon, bootpd (although NetInstall also activates TFTP and NFS). Theoretically, if NetInstall is on but DHCP is off, bootpd should be running but not handing out addresses over DHCP. But in at least some versions there's a bug that can lead to DHCP being fully active despite being "off".

The bug seems to occur when both DHCP and NetInstall are turned on, then DHCP is switched off, but the bootpd daemon doesn't seem to get the message and keeps doing DHCP. Generally, the solution is simple: switch both DHCP and NetInstall off, then switch just NetInstall on.

To confirm, check the log (system.log specifically) on the Mac server, look for entries from bootpd. You should see "BSDP" entries, but not "DHCP". See this Apple support document for some examples (although it has both BSDP and DHCP running).