From where I sit, yes. The overhead of creating a new CGI object is not trivial. It has to read the query string or STDIN (if it can, I don't remember offhand if it caches it) to get parameters, setting things up to be retrieved at will.

Creating a hash means allocating memory and hashing keys you may or may not use.

Passing in $query means dereferencing the object to call a method on it.

Depending on how many parameters you have and how many things you need to call and if you can get by with sticking things in a hash just once and you don't want sticky fields behavior that CGI.pm does so nicely, I'd give the edge to passing in $query. Sometimes I pass a hash.

This is unlikely to be the largest bottleneck in your program, however.