Very easily, that's what machine learning is for.
You can't tell with client side either, so that's a null argument. Anti-cheat is always bypassed, most good cheats don't even run on the same device anymore, completely circumventing any kernel anti-cheat anyway.
On the server, they have all the data of where a player could be, what they could see, what they could hear, what human mouse movement looks like etc. that can all be used to target cheaters in a way they cannot get around. Player reporting would still exist of course for any other edge cases.