To clarify: when everything is set up correctly no source code should be revealed. Check for example https://openacs.org/index.adp - it displays its custom not-found page.
Is the pageroot parameter set correctly? It should point to the www directory beneath the OpenACS root directory, e.g. /web/myservice/www, comparable to this:
ns_section "ns/server/${servername}"
...
ns_param pageroot /web/myservice/www
Also make sure you restart the server and inspect the error log for interesting messages during startup (e.g. load it in emacs and search backwards for the word 'ERROR') and when calling the page that returns the error. The location of your error log depends on the value of the ServerLog parameter in your config file.
