If a great spell is disabled in the server config, players can still find ancient scrolls containing it. In my opinion, this shouldn't be the case, if only so players aren't getting useless scrolls taking up valuable loot space.

This happens because disabled patterns are only checked at cast-time, here.
https://github.com/gamma-delta/HexMod/blob/3c73a7da987aaebddabff2aeb613822dc0156f3a/Common/src/main/java/at/petrak/hexcasting/api/casting/eval/CastingEnvironment.java#L74

My suggestion would be to avoid adding disabled patterns to the registry in the first place by adding a check somewhere around here. You'd probably also want a new set for checking disabled patterns so the existing mishap is still possible.
https://github.com/gamma-delta/HexMod/blob/af03b8c32197b1c6161820b99586e6de34fcf258/Common/src/main/java/at/petrak/hexcasting/common/casting/PatternRegistryManifest.java#L60

This bug was found on HexxyCraft, but my analysis is based on the code in this repo so I don't think it matters.

Have found a place in code to change that I expect will fix this (and did the change), but I'm not sure how to test it to confirm.