Well … I don’t know the content of the files as my PC even refused to edit them. I mean I’m not speaking about lines of code injected in already existing files. I’m speaking about completely new files and, apart from the content of these files, I expected from wordfence a comparative scan able to detect strange named php files on a core folder of the wordpress installation, in particular on a css folder where php files shouldn’t be at all.
Have a fresh copy of WordPress on the left and browse your site files on the right and then press Ctrl+O – the green/white files match and the yellow files will be out of place.
As for Wordfence finding .PHP files with strange names, I am not sure if this is something Wordfence does. Random/strange filenames is only a proxy indicator for malware, though, and does not always indicate an infection (take, for instance, cache files which tend to have very random and strange names)