Never use it for anything involving security. Ever. It's just inviting pain. It's not what it was designed for. With that said, PCG is my go-to for testing

Never use it for anything involving security. Ever. It's just inviting pain. It's not what it was designed for. With that said, PCG is my go-to for testing things that need fast random generators (such as prototyping ideas about hashing-based data structures). It's fast and I haven't encountered situations in practice yet where it causes failures that a stronger random source doesn't. Mersenne Twister, in contrast, can easily be the bottleneck for testing small/fast structures.