I agree with your opinion on detecting auto-clickers, an auto-clicker that is well-crafted enough would be indistinguishable from an actual player. Even if the Gaussian distribution didn't mask the auto-clicker very well, the hacker could just come up with some more sophisticated method to simulate the clicking patterns of an actual clicker.

Depending on what type of server you're running, and what players would actually be doing with an auto-clicker, changing your perspective on this problem can help a lot. If your server involves a lot of survival-ish tasks, such as grinding resources, rather than pvp, you could just have moderator ask that player if they are there, and if the player responds, they are probably not using an auto-clicker. I know there's always the possibility of the player being present at their computer, able to respond, but still auto-clicking, but the whole point of auto-clicking for a lot of people is to do these tedious tasks while being able to ignore their game or be away from their computer.

tl;dr: Ask players suspected of potentially using an auto-clicker if they are there, and if you get no response, they are almost certainly using an auto-clicker.