Governor.sol doesn't check for hash collisions, how secure is it?

The execute() here takes several parameters that could be changed, and thus the calculated hash values too.

Some algorithms were developed to find hash collisions, ex:, but keccak256 uses 24 rounds? So it is currently not possible to find hash collisions?

Almost all Solidity contracts rely on collision resistance of keccak256. Governor is no different.