Just had some fun digging through the code (learning new thing along the way) and I think I see where the problem is. The variable names are a bit confusing. The only originally normal distributed value here is the random number from the bm rng algorithm (standard normal distribution to be exact). "stddev", as it is in the code, is really just the the distance from the middle/mean of the range to its edge.
The idea seems to be to create a normal distribution of stat values by multiplying "stddev" with the bm rng value. Since the mean of this distribution is at 0 you then just have to offset it by the mean value.
This kinda happens in the random_bm function already, but "mean" and "stddev" were dived by 1000 beforehand (creating a random factor for the the rangesize i presume). This makes the calculations in rir_bm redundant. The problem is that this distribution does not fit within the specified range. A solution to this is to just divide the bm rng value by 2 (or up to 2.7) to squish the distribution and then either only accept values between -1 and 1 or just clamp the rest like before. Create a kinda normalized factor so to speak.
To summarize my solution would be: Don't divide "mean" and "stddev" by 1000, divide the original "num" value in random_bm by 2 (up to 2.7) and create a (kinda) normalized factor to multiply "stddev" with and offset it by adding "mean".