From the nss-softokn-3.33.0-1.1.fc26 build log:

cc -o Linux4.12_x86_cc_glibc_PTH_OPT.OBJ/Linux_SINGLE_SHLIB/sha_fast.o -c -O2 -fPIC -Di386  -pipe -ffunction-sections -fdata-sections -DHAVE_STRERROR -DLINUX -Dlinux -Wall -Werror -DXP_UNIX -DSHLIB_SUFFIX=\"so\" -DSHLIB_PREFIX=\"lib\" -DSHLIB_VERSION=\"3\" -DSOFTOKEN_SHLIB_VERSION=\"3\" -DRIJNDAEL_INCLUDE_TABLES -UDEBUG -DNDEBUG -D_REENTRANT -DNSS_NO_INIT_SUPPORT -DUSE_UTIL_DIRECTLY -DNO_NSPR_10_SUPPORT -DSSL_DISABLE_DEPRECATED_CIPHER_SUITE_NAMES -DFREEBL_NO_DEPEND -DFREEBL_LOWHASH -DNSS_X86_OR_X64 -DNSS_X86 -DMP_ASSEMBLY_MULTIPLY -DMP_ASSEMBLY_SQUARE  -DMP_ASSEMBLY_DIV_2DX1D -DMP_USE_UINT_DIGIT -DMP_IS_LITTLE_ENDIAN -DMP_API_COMPATIBLE -I/usr/include/nspr4  -I/usr/include/nss3 -I/usr/include/nspr4  -iquote ../../../dist/Linux4.12_x86_cc_glibc_PTH_OPT.OBJ/../public/nss -iquote ../../../dist/Linux4.12_x86_cc_glibc_PTH_OPT.OBJ/../private/nss -I../../../dist/Linux4.12_x86_cc_glibc_PTH_OPT.OBJ/include -I../../../dist/public/nss -I../../../dist/private/nss -Impi -Iecl -Iverified -O2 -g -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -m32 -march=i686 -fasynchronous-unwind-tables -mno-sse2 -std=gnu99 -mpclmul -maes sha_fast.c

-mpclmul and -maes necessarily require SSE2 support because they operate on XMM registers, so they override the previous -mno-sse2 flag:

Dump of assembler code for function SHA1_Update:
   0xb7445af0 <+0>:	sub    $0x2c,%esp
   0xb7445af3 <+3>:	mov    %ebx,0x1c(%esp)
   0xb7445af7 <+7>:	mov    0x38(%esp),%ebx
   0xb7445afb <+11>:	mov    %esi,0x20(%esp)
   0xb7445aff <+15>:	mov    0x34(%esp),%esi
   0xb7445b03 <+19>:	mov    %edi,0x24(%esp)
   0xb7445b07 <+23>:	mov    %ebp,0x28(%esp)
   0xb7445b0b <+27>:	test   %ebx,%ebx
   0xb7445b0d <+29>:	je     0xb7445b77 <SHA1_Update+135>
   0xb7445b0f <+31>:	mov    0x30(%esp),%eax
   0xb7445b13 <+35>:	xor    %edx,%edx
   0xb7445b15 <+37>:	movd   %ebx,%xmm0
   0xb7445b19 <+41>:	movd   %edx,%xmm1
   0xb7445b1d <+45>:	punpckldq %xmm1,%xmm0
   0xb7445b21 <+49>:	movq   0x40(%eax),%xmm2
   0xb7445b26 <+54>:	mov    0x30(%esp),%eax
   0xb7445b2a <+58>:	paddq  %xmm2,%xmm0
   0xb7445b2e <+62>:	movq   %xmm0,0x40(%eax)
   0xb7445b33 <+67>:	movd   %xmm2,%eax
   0xb7445b37 <+71>:	and    $0x3f,%eax
…

Furthermore, it is not possible to compile code with -m micro-architecture flags and assume that it will run just fine on CPUs which do not support the micro-architecture, as long as you do not use the intrinsics in the code.  This is not how these switches work; they also enable GCC to emit such instructions automatically (e.g., if it recognizes certain coding patterns which could benefit from the new instructions).

GCC versions prior to GCC 7 were less sensitive to that because they would rarely, if ever, emit SSE2 instructions for integer code, especially without -O3 and auto-optimization.

(Note that all present and future Fedora releases support i686 without SSE2.  This is completely different from downstream.)