You discovered the rpm's scripts run a script from the Internet, and that script currently redirects to what might be malware. Although, I'm not finding much of a payload that does anything.
rpm cannot completely track what happened because it is running an arbitrary script.
gpgcheck will not help you, both the
getpagespeed-extras-release-7-1.el7.gps.noarch.rpm you linked appear to have valid signatures:
$ gpg --keyid-format long /etc/pki/rpm-gpg/RPM-GPG-KEY-GETPAGESPEED
pub 2048R/0CD60276222B0E83 2017-03-03 GetPageSpeed Builder <email@example.com>
sub 2048R/059A9010F4F3567D 2017-03-03
$ rpm -K getpagespeed-extras-*
getpagespeed-extras-7-6.el7.gps.noarch.rpm: rsa sha1 (md5) pgp md5 OK
getpagespeed-extras-release-7-1.el7.gps.noarch.rpm: rsa sha1 (md5) pgp md5 OK
Complain to the repo owner that the package runs arbitrary code from the Internet. If it must do so, their software supply chain security needs improving.
It seems a bit paranoid to do the first install of software without Internet access, or manually inspect the "post install" script. But unfortunately almost seems necessary if packages do ill-advised tricks like this.
https://extras.getpagespeed.com/redhat/7/noarch/RPMS/getpagespeed-extras-7-6.el7.gps.noarch.rpmis the original file, it still has an old date in their repo, and
gpgcheck=1is set in it.