Arak and Natanz were built in secret in violation of the NPT and it was intelligence from Iranian exiles that exposed these facts after which Iran acknowledged them.
The existence of this nuclear center [Natanz} was first exposed in 2002 by the
People's Mojahedin Organization of Iran.<a href="
Natanz Nuclear Facility - Wikipedia"><span>[</span>8</a>
en.wikipedia.org
To this day, no one can be certain how long Natanz existed and was functioning before its existence was exposed.
The fact that JCPOA only allowed inspectors to inspect sites Iran declared as nuclear sites made it impossible to detect if Iran was again building nuclear sites in secret.
Saying US did not have evidence Iran was building a bomb is not the same as saying the US knew Iran was not building a bomb; Natanz existed long before the US had evidence it existed.
As long as Iran was allowed to enrich uranium, it retained the ability to build nuclear weapons which it immediately threatened to do when Trump stated in his first administration that he wanted to renegotiate JCPOA, by increasing the level of enrichment beyond any peaceful use. The fact that JCPOA left Iran, one of the most nefarious governments in the world, wreaking havoc and bloodshed across the ME even as the negotiations were going on, with the ability to build nukes makes it clear JCPOA was a failed concept.
In fact, Iran never had a reason to enrich uranium if it was only for peaceful purposes. The IAEA has nuclear sites in which it enriches uranium and processes spent fuel rods for less than it would have cost Iran to do it themselves, so from the start, Iran's whole nuclear program was aimed at having at least a plausible nuclear weapons capability and JCPOA gave it to them.