How about using a different toolchain? (eg: gcc vs clang). Or even different versions of a toolchain? Or a dependency that has to be downloaded? Being able to build consistently requires way more effort than just following professional practices. One method I know is to pin everything that goes into a build - source, dependencies, toolchains, configurations and environment.
Results of non-consistent build can be as simple as a difference in performance. But it could also be a malware injected through the compiler.
Yes, yes and yes.
The toolchain and the dependencies should be pinned.
Otherwise sooner or later you'll hit the customer's issue that you won't be able to reproduce - until you realize it's some subtle bug in the specific version of your compiler.
Results of non-consistent build can be as simple as a difference in performance. But it could also be a malware injected through the compiler.