[For devices with the AES-NI instruction set]

I highly recommend looking at the Davies-Meyer construction based on fixed-key AES. By now, it has been used in dozens of different works, and though it is of course not a perfectly standard assumption on AES, it is quite widely accepted as a plausible one. In particular, it provably yields a PRG when modeling AES as a random permutation.

The construction is as follows:

• Fix two keys $(K_0, K_1)$ once for all. They are public and will never change, hence you will only have to do the key schedule twice.
• On input $x$ of size 16 Bytes, output $(\mathsf{AES}_{K_0}(x) \oplus x,\mathsf{AES}_{K_1}(x) \oplus x)$.

Note the crucial XOR with $x$ (the construction would of course be insecure without it, as AES is invertible given the keys). A similar variant of the above, which requires a single key schedule and provides the same security (when modeling AES as a permutation) is:

• Fix one key $K$ once for all.
• On input $x$ of size 16 Bytes, output $(\mathsf{AES}_{K}(x) \oplus x,\mathsf{AES}_{K}(x\oplus 1) \oplus (x\oplus 1))$.

To read more about this approach, this is the proper starting point. In particular, you will see discussions on related constructions achieving different security properties. I don't think the paper directly proves that the exact constructions I sketched above are PRGs (when modeling AES as a random permutation), but the proof techniques that they use (using Patarin's H-coefficient technique) can be easily adapted to prove it (I worked out this exact analysis over the summer).

There are dozens of papers using this construction to implement the PRG required for the GGM pseudorandom function. This is especially common for implementing function secret sharing, or for building MPC-in-the-head post-quantum signatures (I can provide a sample of pointers upon request).

As for speed, fixed-key AES with the AES-NI assumption can be as fast as 1.3 cycles per Byte, which seems very hard to beat (XORs are of course super fast as well, especially using vector instructions). See e.g. here for a reference that indicates this number.

[For devices with the AES-NI instruction set]

I highly recommend looking at the Davies-Meyer construction based on fixed-key AES. By now, it has been used in dozens of different works, and though it is of course not a perfectly standard assumption on AES, it is quite widely accepted as a plausible one. In particular, it provably yields a PRG when modeling AES as a random permutation.

The construction is as follows:

• Fix two keys $(K_0, K_1)$ once for all. They are public and will never change, hence you will only have to do the key schedule twice.
• On input $x$ of size 16 Bytes, output $(\mathsf{AES}_{K_0}(x) \oplus x,\mathsf{AES}_{K_1}(x) \oplus x)$.

Note the crucial XOR with $x$ (the construction would of course be insecure without it, as AES is invertible given the keys). A similar variant of the above, which requires a single key schedule and provides the same security (when modeling AES as a permutation) is:

• Fix one key $K$ once for all.
• On input $x$ of size 16 Bytes, output $(\mathsf{AES}_{K}(x) \oplus x,\mathsf{AES}_{K}(x\oplus 1) \oplus (x\oplus 1))$.

To read more about this approach, this is the proper starting point. In particular, you will see discussions on related constructions achieving different security properties. I don't think the paper directly proves that the exact constructions I sketched above are PRGs (when modeling AES as a random permutation), but the proof techniques that they use (using Patarin's H-coefficient technique) can be easily adapted to prove it (I worked out this exact analysis over the summer).

There are dozens of papers using this construction to implement the PRG required for the GGM pseudorandom function. This is especially common for implementing function secret sharing, or for building MPC-in-the-head post-quantum signatures (I can provide a sample of pointers upon request).

As for speed, fixed-key AES with the AES-NI assumption can be as fast as 1.3 cycles per Byte, which seems very hard to beat (XORs are of course super fast as well, especially using vector instructions). See e.g. here for a reference that indicates this number.

=== EDIT (answering OP's comment below) ===

As far as I know, Davies-Meyer and Matyas-Meyer-Oseas are two slightly incorrect ways of referring to the same construction (the one I described above). Originally, both Davies-Meyer and Matyas-Meyer-Oseas are compression functions to be used in hash function constructions from block ciphers:

• Davies-Meyer: $H_i = E_{m_i}(H_{i-1}) \oplus H_{i-1}$ (i.e. the next block is computed from the previous block using the current message block $m_i$ as the key)
• Matyas-Meyer-Oseas: $H_i = E_{g(H_{i-1})}(m_i) \oplus m_i$ (i.e. the next block is computed from the message block using the some function of the previous block as the key)

In our context, the key is always fixed anyway and there is no compression function - we're building a PRG. But the design is somewhat analogeous to either of the above and can be seen as either with a slight abuse of definitions of what counts as the previous block and what counts as a message block.

I think the terminology Matyas-Meyer-Oseas was the one originally used here, but later works (e.g. this one) switched to Davies-Meyer, probably because it felt a slightly more accurate naming (but both are debatable).