The Quake2 server comprises an executable (quake2.exe) and a game DLL (gamex86.dll on INTEL systems). I will refer to them as the Quake2 engine and the game DLL. The game DLL is responsible for the AI of the monsters, weapons, bots and other "game-rule-related" things.
In contrast to the Quake2 server, the quake2 executable also contains a client part, which is connected to the server over a network, or locally if possible. This makes it possible to run a dedicated Quake2 server, which runs the game DLL and has a number of clients connected to that server in runtime. The clients need not even have that game DLL. It is the server that dictates the events and controls the entities in the Quake2 world. Everything conceived by the server is conveyed as network messages to the clients. They only have to render and tell the server what the connected player is up to.
Quake2 is also accompanied by PAK-files. A PAK-file contains one or several maps, which comprise the Quake2 world. Also, they contain information about where entities, like monsters, are placed in the world.
Id software has chosen to release the source code for the game DLL, at least up to version 3.14 of Quake2. This means that an experienced C-programmer can change the rules and behaviour of the game. A combined effort between a C-programmer and a graphics artist, fond of using Qole or similiar tool, can result in a completely different game running on top of the Quake2 3D rendering engine.
However, the possibilities are not endless. You are still bound by the specification of the network protocol when starting visual effects like sparks, smoke trails and alike in the Quake2 world. You are also bound by the limitations of the rendering engine.