> a non-CSPRNG makes sense, as they're still faster

Nowadays with highly optimized and often hardware-accelerated crypto, I honestly doubt it matters.

Using "openssl rand", I can generate randomness 2x as fast as with a naive

  while (1) { r = rand(); fwrite(&r, 4, 1, stdout); }

compiled with -O2. If I replace "openssl rand" with "openssl enc -aes-128-ctr < /dev/zero", I get randomness 4 times faster again, i.e. 8 times as fast as with the naive approach using rand(), hundreds of megabytes on a single core.

And I don't have to worry about the properties of the PRNG.