When I do "rpm --verify at" with at-3.1.8-1 installed, I see ".M...... /var/spool/at/.SEQ". It's normal for this file to be modified during daily operation of at, so what I SHOUlD see is the string above with a "c" in between the status chars and the file name. I.e., this file should be marked a configuration file in the at spec file.
%config is wrong; then it could get shuffled around on upgrades, which is probably not what you want. %verify tweaks should be enough. Fixed in 3.1.8-4.