By default, regular user accounts are allowed to create 10 machine accounts. This is controlled by the value of the ms-DS-MachineAccountQuota attribute on the domain object. You can edit this value with ADSIEdit.
It’s not the AD permissions, by default the permissions on the Image share allow Authenticated Users access. Changing the AD attribute will prevent users joining PCs to the domain, not from PXE booting.