Just to add some clarification;
dfhack.run_command takes a single string exactly how it would if you typed it in the command line (just as Fleeting Frames said). It can be a little dangerous to use though as it can also run potentially harmful things as it doesn't have to be a dfhack script that it runs (although I'm usually not worried about that from modders from this forum, it is worth noting, and I would suggest always making it clear what you are calling with run_command, i.e. don't hide the call in some other variable).
dfhack.run_command("modtools/create-unit -race holiday_LEPRECHAUN -caste MALE -name PLAINS -location " .. '[ ' ..tostring(pos.x)..' '..tostring(pos.y)..' '..tostring(pos.z).. ' ]')
dfhack.run_script take a string which is the script name (e.g. "modtools/create-unit") then a set of arguments which essentially maps to replacing a comma in every space in your run_command call (thanks to Fleeting Frames for pointing out that you have to split up a position call).
dfhack.run_script("modtools/create-unit","-race","holiday_LEPRECHAUN","-caste","MALE","-name","PLAINS","-location","[",pos.x,pos.y,pos.z,"]")
Now the reason you got that error is because right before that call you changed what the variable pos was
pos = getPositionSurface()
pos = '[ ' ..tostring(pos.x)..' '..tostring(pos.y)..' '..tostring(pos.z).. ' ]'
print("leprechaun positioning:", pos)
dfhack.run_script("modtools/create-unit","-race","holiday_LEPRECHAUN","-caste","MALE","-name","PLAINS","-location","[",pos.x,pos.y,pos.z,"]")
So that pos.x, pos.y, and pos.z would all return nil. If you take out the pos = '[ ' ..tostring(pos.x)..' '..tostring(pos.y)..' '..tostring(pos.z).. ' ]' line it should work.
And just to give a more mathematical description to the %16 in case you are unfamiliar with modulo
pos.x = 132
pos.x%16 = 132 modulo 16 = 4
132/16 = 8 and 4/16
As for Meph's question, as written the script would run in adventure mode, but you could add an extra if statement making sure that it only runs in fortress mode really easy.