The delay should not be simply random, it would need to be carefully chosen to make the load time distribution independent of the user loading the page. Otherwise an attacker could just average multiple requests to get rid of the randomness.