I made a spinning object using AngularVelocity and AlignPosition. It works perfectly fine, but for some reason, it replicates to the server from the client which means that any exploiter could just disable them and break the spinning object for everyone.
Is it possible to not make it replicate from the client to the server?
How do you mean that they replicate? Workspace entities can only be edited locally for the client by the client unless there is an explicit access Backdoor which accessed a script made to do just that. The client can’t delete the parts in the workspace for the rest of the server. If you have a child parented to a workspace part, the only thing the client can do is remove that part from their local game. Not for the rest of server
It does replicate for the server though.
Have you tested this with a Test session? Also. If you click on the “Current Client” button in the Test Tab while running the game is it still missing? Clicking on current client will allow you to switch to the Server side of the space. The part will still be there on the server is my guess.
Can’t you just make it server-sided by changing their CFrame. 
I disabled it on the client to the furthest left and it does replicate to the server, unfortunately.
Are you sure this is running on the client?
Describe your process of creating these instances.
Could you screenshot the model and it’s children?
Are you sure you have FE on? (Sometimes it doesn’t automatically enable)
The spinning model is pre-made and stored in ServerStorage. It is then cloned and parented to Workspace.
FilteringEnabled is also enabled of course.
Just thought of this, BasePart:SetNetworkOwner(nil) will change the network owner to the server. It may decrease the quality of the physics but it’s secure.
Forgot about clients owning unanchored parts lol.