Using SHA1 to obfuscate published resource IDs
(should I) use something else (than SHA-1)?

Yes. That seems to be a good application of purposely slow hashes intended for password hashing, like Argon2id, or it's ancestor scrypt, or (if all else are unobtainium in the context) SHA-2 followed by bcrypt (don't even google PBKDF2-HMAC-SHA-1, which is obsolete).
These are like SHA-1, less cryptographic break of it's resistance to collision, plus an output size parameter, a plethora of extra inputs for key as HMAC or/and other salt/associated data should that be needed. And most importantly parameters to tune the execution speed; with the whole thing crafted in a way such that adversaries using GPUs or ASICs for brute force search of valid string won't gain so much advantage over using a CPU, as legitimate users do.
This will let you increase security significantly at equal size and number of IDs, or/and safely reduce size of IDs. Just tune the parallelism parameter to the minimum number of physical threads on all platforms using the system (perhaps less 1 or 2 to keep the thing user-responsive, but with a minimum of 1; use 1 if in doubt); memorySizeKB to the lowest free RAM available on all platforms (for all threads, less a fair safety cushion, including for launching the stated number of threads/processes); then up iterations to what's tolerable on all platforms.