On the replication and uniqueidentifer topic:

PK is required for transactional and merge. It must be declared as such or else you can't even create a publication with that table as an article. A rowguid is nice but not required. If you don't have one, replication makes one for you. This is so under the hood that it may not even show up on the screen (I don't have one that fits this requirement to check; our merge pubs all declare explicit uniqueidentifiers). So you can still create a merge/updating transactional publication without having a uniqueidentifier, but that doesn't mean that SQL is not creating and using one off in the background for you.

And yeah, I could easily see the confusion for this vs. unique clustered index. It's a similar concept, and that IS just a 4 byte value.