My stupid suggestion: try installing an older version that doesn't need phonetz. It was new in 1.14, so 1.13.2 can be found here: https://sourceforge.net/projects/ncid/files/ncid/1.13/
Your best option would be to download the source code from https://sourceforge.net/projects/ncid/ and compile it in your environment. Step-by-step instructions for the compile are in the User Manual from https://ncid.sourceforge.io/doc/doc.html or if you prefer html, in this section https://ncid.sourceforge.io/doc/NCID-UserManual.html#instl_deb_comp
I've pulled out the code and tested it by itself. While different from the other places where this is done, it is formatting the time correctly. The time that comes out is timezone shifted from UTC, and will be the same as if ncidd used the 'date' command. Try comparing the results from 'date' and 'date -u'. You can throw your own empty test calls into ncidd to check the time by connecting with netcat. e.g. I typed this ~~~ netcat localhost 3333 CALL: ###NMBR6137778888...NAMEtime test+++ GOODBYE...
Are the times in ncidd.log also incorrect, or would it just be wrong for that one call record? (The code that formats the CID line for the missing caller ID is a bit different fro the other time formatting.)
When the option gencid=1, which it appears to be here, a CID record will be produced on the second RING, since caller ID is expected to come before the second RING on a POTS call. The timestamp in the record comes from the system clock when ncidd calls gettimeofday(). The same code is used for the timestamps that appear in the ncidd.log file.
Yes, regex=0 is the default. It's not mentioned in the User Manual, but it is in the comments in the ncidd.conf file.
Yes, the quotes will work to allow you to put spaces in the expression text.
I have no idea why my reply has some words coloured green.