It seems like the Client uses the version bit to determine the type of Player: http://wiki.vg/Protocol#Spawn_Player

It states that for NPCs UUIDv2 should be used... Still I think Citizens has its reasons to do it this way. If they generate a UUIDv4 and set the version to 5, we should do too.