This is a known issue in older version of the OpenSSL library (which SecureRandom uses.)
It is (or was discussed) I think in the GitHub issue tracker.
I did post a “trick” using a temporary component definition in this post …
ComponentDefinition#guid at the model level? - #4 by DanRathbun
This thread was entirely devoted to the generation of GUID or UUID for extension usage.