To optimize performance you can define the CSFOWH (hash) and CSFRNG (random number) profiles in the XFACILIT class. This will disable SAF/RACF checks for these profiles. ICSF uses CPACF instructions for these anyway and CPACF instructions cannot be protected by SAF/RACF. Consult your security team to make sure this is acceptable.

Example: RACF instructions

RDEFINE CSF.CSFSERV.AUTH.CSFOWH.DISABLE CLASS(XFACILIT) UACC(READ)
RDEFINE CSF.CSFSERV.AUTH.CSFRNG.DISABLE CLASS(XFACILIT) UACC(READ)
SETROPTS CLASSACT(XFACILIT)
SETROPTS RACLIST(XFACILIT) REFRESH