The -+ matches all dashes at the start/end of the string, but you're replacing them with a single ?. You need to stuff in as many question marks as there were dashes. One way out of many, using eval (/e):

use 5.012;

my $string = "---------xxxxxxxxxxxxxxx------yyyyyyyyyyyyyy--------";
say $string;
$string =~ s/(\A\-+|\-+$)/'?' x length $1/eg;
say $string;
[download]

Output:

---------xxxxxxxxxxxxxxx------yyyyyyyyyyyyyy--------
?????????xxxxxxxxxxxxxxx------yyyyyyyyyyyyyy????????
[download]