Private servers are legal in general. The use and distribution of SEGA copyrighted content isn't. Meaning, you could be a 100% legal pso private server if you never hosted any client files and never used any of SEGA content including the use of quests, config files, etc. (Which means goodbye vanilla pso and users would have to grab the client files elsewhere of their own accord.)
Both the users and the private servers are breaching the digital millenium copyright act by using and sharing SEGA's copyrighted content. That said, in alot of countries (Other than USA), law enforcement doesn't care too much about the downloading of said content, but rather care about those who share the content. Which means, the target of such laws is usually the server owners and never the users. It's also not very efficient to target random users when the company can just target a handful of servers. But these rules are slowly changing towards a more strict approach over time and nobody knows what the future holds 10 years ahead. You are dwelling on a greyline by playing on private servers in the same way you are playing retro games on emulators.
I'll be honest. While it's technically possible for a private server to be 100% legal, I've never actually witnessed a private server that was truly legit. The software is sometimes legal, sometimes not. However, as soon as someone makes their own private servers, they need to host files/data for the players and it's not legal anymore.
Even as far as psobb private server development goes, there's another factor to consider. To actually reverse engineer and add content to PSOBB nowadays, you don't really have a choice but to download and run the game in a non-legal way. This means the developers are also breaching the DMCA regardless of what people think. This can be different for older versions of PSO since the player actually purchased the game, but PSOBB has a EULA/Terms of service that was breached long ago.