I've only had the ROM on my phone for a couple of days, but I'm already enjoying it. I think the customizations are a great complement to the awesome LineageOS.
That first of all. Now for the things I found out. I'd really like to continue using the ROM, but these two problems are making me nervous. Thanks to American_Jesus, I was able to do a little more research.
Using LibreAV I generated the SHA265 hashes of these two files. Then I was able to check these hashes with VirusTotal.
This is what VirusTotal found:
PowerOffAlarm:
c3bd00ed52179ef3a9f568db12a83594e356d49b5165958ac1464244cf5c30ce
1/65 - Avast-Mobile:
APK:RepMalware [PUP]
"APK:RepMalware is a heuristic detection designed to generically detect a Potentially Unwanted Application. A potentially unwanted application is a program that contains adware, installs toolbars, or has other unclear objectives. Files reported as APK:RepMalware may not necessarily be malicious."
LINK to Malewaretips
LTE Broadcast Manager:
37dc9466824cdbbff996016c214b66cbed4de87c281b63e1dd36604129d3a6bd
1/61 - Trustlook:
Android.PUA.DebugKey
"android.pua.debugkey is not a virus. It is a debug keystore file that is used to sign Android applications during development. It is created by the Android SDK and is used to sign apps with a self-signed certificate so that they can be installed and run on an Android device or emulator during development. However, it is important to note that the debug keystore should not be used to sign apps that are intended for distribution, as it is not secure and can be easily compromised."
LINK to Modiod
And now, Mike, what does that mean?
It seems that both apks are harmless. Please teach me better.

VirusTotal shows only 1 alert out of 65/61. That means something.
BUT there are several versions of PowerOffAlarm and LTE Broadcast Manager available for download on the internet and none of them even issued an alert on VirusTotal.
Why is the developer of crDroidAndroid taking this "risk"? Yes, I know now these files come from the Android SDK but why not exchange them for signed versions? LineageOS does that too, at least with PowerOfAlarm (no LTE broadcast manager in LineageOS).
I've calmed down a bit now but still have questions.