In this case, you're using CBC, which requires an unpredictable IV, so this is a security vulnerability. To quote Wikipedia:
If an attacker knows the IV (or the previous block of ciphertext) before the next plaintext is specified, they can check their guess about plaintext of some block that was encrypted with the same key before (this is known as the TLS CBC IV attack).
If your library is used to process multiple PDF files that may use the same key and an attacker can see the output of one before submitting more data to be encrypted, then they will be able to verify a guess for a previous plaintext. This may seem far-fetched, but I bet you there are in fact many tools which generate PDFs on demand like this.
In general, you can generally assume that it is never safe to use a non-cryptographic RNG for any aspect of a cryptographic operation. That's because for most non-cryptographic RNGs, the entire state can be predicted given enough output (this is never true for CSPRNGs) and thus an attacker can generally guess every output, past, present, and future.
I will also mention just for the record that RC4 (ARC4) is completely insecure and shouldn't be used, but I'm sure that this is for compatibility only.