If we need some kind of POW for randomness, why not directly use bitcoin blockchain as source of RNG? The random number can be something like the future nth block's hash. As bitcoin mining involves randomness, it's more secure for a random number generation. The block's hash is difficult to find and it will be difficult for a miner to adjust the hash to his will (to win a lottery) even if he has say 51% power. If we carefully choose the way to use the hash(like hashing it to get the result number), it can be very difficult (if not impossible) to control the result of lottery.
Maybe we can even chain the blocks by using the hash as another block's index to make it more difficult but I'm not sure whether this will break the randomness.
The down side is that every node (or at least some nodes) needs to download 2 chains to verify the block. But considering the mining power on bitcoin, I think it's worth to directly use bitcoin chain. To improve this, some nodes may choose bypassing download of bitcoin blockchain by not verifying the random number generation or directly getting hash value from some online services like blockchain.info.