In the case of Shellshock, I speculate that it uses Axis-Aligned-Bounding-Box tests to do the collision handling. ZombiesWithGuns I believe does something similar, but uses a simple voxel representation of the world. In this case a voxel is either occupied or free space.
If we take Shellshock as an example, you really only need a collision engine based on AABB-AABB intersection and resolution. There are numerous sources on the internet, and it is some of the simplest collision checks to implement.
Another reason to avoid a physics engine is the fact that the client and the server will run two different versions of the physics world, and update at different times using different data. When you use a velocity based physics engine, you will Constantly have to correct differences between the client and the server. For this reason most FPS-games use the kinematic approach to entities, as in this case, you can update your entity whenever needed, and one unit on the client, is one unit on the server.
When it comes to hitboxes, I assume Shellshock uses a single box (same as collision) to do any hit testing. ZombiesWithGuns on the other hand, uses all the meshes making up the visual part of the entity. It does not use a skeletal/skinned mesh, but multiple meshes(body, head, leftUpperArm etc)
This is the way I would go, even if I was using a skinned mesh. Just recreate a simplified version of your player using only box primitives in a hierarchy (upper-body is a child of torso, leftUpperArm is a child of upper-body) and give them the exact same animation as your skinned mesh. Now you have a group of boxes to hit test against, and you won’t have to run an animated, skinned mesh on your server. You don’t even have to instantiate these hit boxes for every single entity. In fact, you only need one group. Whenever the server detects a ray hit the bounding box of some entity, you move/rotate the root of the hit boxes according to your entity, set the animation frame of the hit boxes to that of your entity, compute the word matrices, and test against all boxes.