Is there a problem with constructing a CSPRNG using MD5 or SHA1? Is there any security concerns with building a CSPRNG using a broken hash function like MD5 or SHA1?  The design is such that a CRC-like function is used for mixing entropy and MD5 is used as the output function.  If this is a security concern, what is the technical reason?  What would be a better replacement when efficient is a concern?
Well, it is quite possible to have a CSPRNG that uses MD5, or SHA-1, despite their known flaws.  In fact, see Hash_DRBG with SHA-1 for an example that is officially endorsed by the US Government.  They don't endorse it for MD5; however, they really don't endorse MD5 for any reason (except within the TLS key derivation function).

The problem with MD5 and SHA-1 is that it is possible to create two different images that hash to the same value (with MD5, it turns out that you have quite a bit of flexibility, with SHA-1, it's been estimated to be practical, however I have not heard of anyone actually generating a colliding pair).  However, creating a collision means that the attacker gets to select both pairs; with a CSPRNG, the attacker cannot influence the internal state (he can only observe). This implies that the ability to create a collision has no impact on CSPRNG security; after all, even if the attacker generates a colliding pair, he has no way of making the CSPRNG use one of the preimages he has created.

Also, one warning: just because it is possible to design a CSPRNG based on SHA-1 or MD5 doesn't mean that design that you have in mind is actually secure.

Now, when you talk about efficiency, well, SHA-1 and MD5 aren't great; they're designed to hash things quickly, not generate hashed bytes quickly (oddly enough, those aren't the same thing).  The CTR_DRBG CSPRNG from the same document is somewhat better; however, the output of a good keystream generator (such as ISAAC) is going to be faster still.