I generally work with prod backups (it's not uncommon) because you get realistic performance and it makes debugging live bugs much easier.

I prefer to have an annonymization script but many companies are too cheap to allocate time for one.