It was caused by the TICCMD_RECEIVED flag only being set for the first local player, causing the server to continuously reuse the input from the previous tic.
TICCMD_RECEIVED