As dfranke said, it isn’t trivial to filter out the noise of having other code running in parallel to your code from that. Counting clock cycles, not wall clock time isn’t even enough as some attacks use wall clock time.

And it’s worse: that your code is constant-time in the absence of an adversary doesn’t guarantee that it is so in the presence of one. You will have to stress test your code with code running in other CPU threads that flush various caches, switch CPU modes, do DMA, etc.

Having said that, running with random inputs isn’t a bad idea, if only because you have to get confidence that the CPU manufacturer’s timing data is correct.