https://tests.reproducible-builds.org/debian/rb-pkg/unstable/amd64/diffoscope-results/userv.html Shows differences in build-id in executables, and a date in spec.pdf.gz.
The attached patch fixes the easy part of userv's reproducibility. Apparently TeX doesn't believe in SOURCE_DATE_EPOCH unless you also set FORCE_SOURCE_DATE. So this patch just unconditionally sets the latter in debian/rules, which seems to work. The unreproducibility of pcsum.h is fiddlier and I've not worked it out yet.
I've taken the liberty of cloning the userv non-reproducibility bug into two. This one (1092896) covers non-reproducibility caused by pcsum.h, which causes the binaries to be slightly different. This isn't detected by reprotest, but can be seen here: https://tests.reproducible-builds.org/debian/dbd/unstable/amd64/userv_1.2.1.diffoscope.html#userv_-.-.-_amd--.deb---data.tar.xz---data.tar---.-usr-bin-userv---objdump---line-numbers---disassemble---demangle---reloc---no-show-raw-insn---section-.text--- I think it's caused by some change in config.status, which gets hashed to form pcsum.h, but I've not worked out what the change is.