The two legitimate ways to get Amiga ROM files for WinUAE are either to rip the images yourself from a real Amiga (using transrom I think), or by buying Amiga Forever 5 from Cloanto.
I managed to find a CD32 ROM file and a CD32 Extended-ROM file for WinUAE by doing a Google search, because although I own a CD32 (three in fact), at the time I didn't have the means to rip the ROM's myself (no floppy drive back then). So hopefully it was still legit! :-)
Steve.