The six random characters at the end of the systemd-private directory name are only there to guarantee that the directory name is unique and doesn't conflict with any existing directories when it is created. As of systemd v245, this is set up in
src/core/namespace.c. That function calls
mkdtemp() to create a unique temporary directory, and
mkdtemp() generates the random suffix to guarantee uniqueness.
I haven't found a way to extract the current temporary directory path for a given unit directly from systemd, but if you really need it, you can get that information in these two steps:
systemctl show some.service -p MainPID and extract the PID (or obtain the PID of any one process in the unit in some other way)
/proc/ThePID/mountinfo for the mount you're interested in (
/var/tmp) and extract the path from there.
Note that you only need to do this if there's more than one systemd-private directory for a machine-unit combination present. That is in itself a rare occurence, because systemd removes these directories for units that stop running for any reason. Of course, someone could go and create a systemd-private directory to confuse you, so don't just do
systemd-private-$bootID-some.service-* when security is a concern.