How to combine pepper in random string generation
First of all, you should just trust the random source that the OS provides and call it via os.urandom(n). Not only is it generally safe, but if your OS is unsafe you may have bigger problems on your hands.

If you really do want to use your pepper as an input to the random bytes that are generated, the obvious way would be to encrypt the OS's stream using a block cipher. You then use the ciphertext as your new random source.