By decault, it uses a Cryptograpically Secure Pseudorandom Number Generator (CSPRNG), specifically .NET's System.Security.Cryptography.RNGCryptoServiceProvider.
It gives good enough results to ensure dice rolls are not biased (one of the tests in my test suite is to perform 10 million rolls and ensure that each possible result is within 0.5% of a completely even distribution). Care has been taken to ensure there is no bias in the math operations (such as modulo) to finesse the result into the appropriate range.
It is possible to plug in a true RNG instead of using a CSPRNG, but I do not believe that the DDB staff have done so. They can correct me if I'm wrong 🙂
That would be a terrible idea and would not work. Random.org's API takes multiple seconds to request random numbers from, and the nature of D&D Beyond means that it would likely quickly both run into limits and run afoul of its API guidelines. Roll20 does not expose an externally-accessible API.
Short of DDB plugging in a hardware RNG, a CSPRNG provides nearly the same level of randomness. A normal PRNG is terrible and biased, but CSPRNG are crafted to remove the bias between grabbing multiple sets of numbers. You can still deterministically generate numbers if you know the seed, but these are seeded using a multitude of factors which would make it nearly impossible for you or anyone without a wide swath of information about the operating environment to figure out what it was seeded by.
How do I use this function to calculate x to the power of y?
There is no exponentiation in the roller, so you would need to multiply x together y times. If y is unknown, then this will be a difficult if not impossible task, depending on what sort of properties you can assume about y.