Definately server side. Client side would be dumb. Now if you ask if they are truly random... maybe they are not. Gamers are more likely to quit for the day, and eventually forever, if they have a bad streek. Getting loot will counter that. So there is a reason why a game developer might want to give poor performing players higher chances for loot.