Technically SHA3 (keccak) already has the SHAKE mode, an extensible output function (XOF). It's basically a hash with arbitary output length (with fixed state size, 256 bits is the common choice). A little bit like hooking a hash straight into a stream cipher. 

The other modes should *probably* not allow the same behavior, though. I can't guarantee that however. 

You may be interested in looking at parameterizable ciphers and if any of them might be applicable to PoW. 

IMHO the best option if we change PoW is an algorithm that's moderately processing heavy (we still need reasonably fast verification) and which resists partial state reuse (not fast or fully "linear" in processing like SHA256) just for the sake of invalidating asicboost style attacks, and it should also have an existing reference implementation for hardware that's provably close in performance to the theoretical ideal implementation of the algorithm (in other words, one where we know there's no hidden optimizations). 

Anything relying on memory or other such expensive components is likely to fall flat eventually as fast memory is made more compact, cheaper and moves closer to the cores. 

That should be approximately what it takes to level out the playing field in ASIC manufacturing, because then we would know there's no fancy tricks to deploy that would give one player unfair advantage. The competition would mostly be about packing similar gate designs closely and energy efficiency. (Now that I think about it, the proof MAY have to consider energy use too, as a larger and slower but more efficient chip still is competitive in mining...) 

We should also put a larger nonce in the header if possible, to reduce the incentive to mess with the entropy elsewhere in blocks.