The C rand() function should never be used in server code.

It's a very weak random generator.

It's not guaranteed to be reentrant.

It's hard to control (and easy to forget to control) the seed https://jira.mongodb.org/browse/SERVER-72366

All callers should be changed to use PseudoRandom or equivalent mongo/platform/random.h facilities.

mongo/platform/random.h should provide a way to get a parameter-controlled and injectable seed. Perhaps from a keyed registry of them? For testability, components should be able to use their injectable random seed in peace without worrying about other unrelated components messing up the sequence by adding requests for random numbers from the same source (BF-27216). A global singleton pseudorandom generator should therefore not be created.

There is some server code that uses rand() today, incorrectly.
These should be upgraded to PseudoRandom at least.