It's a very good way to make sure that if those clients need to route their internal networks to each other, they don't have to renumber. If two companies using 10.x.y.z networks merge, you are likely to end up with a mess. Heck, if you need to VPN to a 10.x.y.z network and your local network is also 10.x.y.z, you'll end up with a mess.

(The IPv6 solution here is Unique Local Addresses, where fdXX:XXXX:XXXX::/48 are all permissible local networks, and if you use a decent RNG to generate the 40-bit number XXXXXXXXXX, you're unlikely to hit a collision with any other actual, active site, let alone one you might want to route to.)

Instead of using fd with a RNG, you should follow the RFC...

SixxS even runs a registry for ULA prefixes: https://www.sixxs.net/tools/grh/ula/

Put in your MAC address, get back a ULA. Then register it so that in the future if someone happens to have the same mac address you don't accidentally use the ULA.

I'm following the RFC: "Locally assigned Global IDs MUST be generated with a pseudo-random algorithm consistent with [RFC 4086]. Section 3.2.2 describes a suggested algorithm."

I happen to be of the opinion that /dev/urandom is more likely to comply with RFC 4086 than the suggested algorithm, but I may have an unfairly low opinion of the distribution of timestamps and MAC addresses.

HP owns two /8 subnets. I know they use them at least partly for internal address space.

NAT is clumsy ;)