if it's done locally then people will bodge the client so the random is no longer random. The server's always going to have to do the math, even if to just ensure the client's not lying.