Standard "cup / dip" tests used for randoms given to CVX employees test for the metabolite of Delta 9 THC, and should not pick up on the metabolite created by CBD.
People often only talk about "THC" when it comes to the psychoactive part of can–bis, but the part that is being tested for is actually the metabolite for delta 9 THC. There is another component of total THC called THCA, which by itself is not intoxicating but after heated, or allowed to sit over a long enough period, will convert to delta 9 THC. So yes....the CBD product you legally purchased was sourced from a hemp plant containing less than .3% delta 9 THC...but doesn't account for % makeup of THCA in the plant...when converted to delta 9 THC...can make the product as high as 7%
That said, many CBD products come in "Full Spectrum"...meaning they contain all cannabinoids like CBG, CBA, CBD THCA and Delta 9 THC. Also taking small doses of THC every day, over long periods of time can also result in an accumulation of delta 9 THC metabolites in your system that could trigger a positive d–g test.
IF you want to use CBD, it's best to use CBD Isolate...which only contains CBD, or use "Broad Spectrum" CBD, which contains all other cannabinoids, except for THCA & delta 9 THC.
Always read the lab reports for the product you're using and get from reputable vendors...since the consequences are so high.