URL paths in optimized CSS sometimes are https instead of http
I don't think the behaviour is random.

These files are regenerated periodically, and the regeneration is mainly going to be triggered by visits to pages. I would guess that the urls in the CSS files get http when the page that triggered the regeneration has http, and https when the page that triggered the regeneration has https.

Prepending the URLs in CSS with the full protocol and domain is not a stock Drupal behaviour, so something in your setup is doing it–probably whatever module you're using to set up the CDN. You don't mention which module you're using for this, so it's difficult to say. I would begin by looking in the module settings.

It's also possible that your CDN service itself rewrites the urls in CSS files. Cloudflare, for example doesn't do this, but does have configurable options that rewrite certain files (such as, e.g., minifying css, js, or html).