From the integrity check output I would have expected it at /path/to/nextcloud/core/.rnd 
. Not sure why the full path is not shown there.
Perhaps if it’s in webroot, it is excluded from the check, but not if inside a sub dir.
Indeed, just checked, and I have /path/to/nextcloud/.rnd as well, but no integrity check issue.
Further research about where they come from: https://askubuntu.com/a/379947
- Looks like from OpenSSL. According to the link you can safely remove them. Should be recreated automatically, if needed by OpenSSL.