Well, a third option would be that the raid boss is a random pokemon species at a given (random or not) level that just benefits from a fixed stat multiplier that depends on the gym tier (like tier 1 = stat x 1.25, tier 2 = stat x 1.5 and so on). It seems unlikely to me.
However, there could be one fixed stat multiplier randomly chosen among 5 different stat multipliers (A) for each raid battle. That would set the "potential difficulty' of the raid. Then pokemon species (B) and level (C) are set randomly. A x B x C = Boss CP, which would define its tier (for example, less than 3000 = tier 1...).
Still, I prefer the legendary hypothesis :)
