You need to double check the library you're using. For example, older versions of the Python standard UUID library would fall back to an insecure RNG silently.
It's easier to just read 16 bytes from /dev/urandom and encode it in hex/base64 yourself for a random token.
Getting pedantic, but a proper uuid lib should be returning 122 bits of randomness, and six bits of fixed information that specify the uuid version and generation method ("random").
For what purpose? Where's the real world reason and interop? Just because an RFC says to set some bits? Is there any code you're likely to hit in your app that actually cares?
I guess the purpose is to be able to put different UUID generation schemes into separate kind-of "namespaces".
That way, a UUIDv4 (random) will never collide with a UUIDv1 (timestamp+mac+...), which again will never collide with UUIDv5 (SHA-1).
So if one of the UUID generation schemes is flawed, these are easily filtered out, and moreover, will never interfere with any other UUID version/scheme.
