That's what I meant by strengthening the regex. Note that the non-conformant additional third line is left untouched:

#! perl -slw
use strict;
my $data_stg
    = 'junk text update 8923 mark complete update 8324 mark '
    . 'complete more junk update 5438 and 5843 and 1522 mark '
    . 'complete more junk update junk and 5843 and 1522 mark '
    . 'complete update 8435 and 9323 mark complete true junk'
;

$data_stg =~ s[update ((?:\d+|\s|and)+) mark complete]{
    join ' ', map{ "update $_ mark complete"} split '\s+and\s+', $1
}ge;

print $data_stg;

__END__
## Output wrapped to match input for easier verification.
junk text update 8923 mark complete update 8324 mark 
complete more junk update 5438 mark complete update 5843 mark complete
+ update 1522 mark 
complete more junk update junk and 5843 and 1522 mark 
complete update 8435 mark complete update 9323 mark complete true junk
[download]

Alternatively, verify that the split values are numeric, produce a warning and put the original back if not:

#! perl -slw
use strict;
my $data_stg
    = 'junk text update 8923 mark complete update 8324 mark '
    . 'complete more junk update 5438 and 5843 and 1522 mark '
    . 'complete more junk update junk and 5843 and 1522 mark '
    . 'complete update 8435 and 9323 mark complete true junk'
;

$data_stg =~ s[(update (.+?) mark complete)]{
    my @numbers = split '\s+and\s+', $2;
    if( grep{ !/^\d+$/ } @numbers ) {
        warn "Malformed request: '$1'\n";
        $1;
    }
    else{
        join ' ', map{ "update $_ mark complete"} @numbers;
    }
}ge;

print $data_stg;

__END__
## Output wrapped to match input for easier verification.
Malformed request: 'update junk and 5843 and 1522 mark complete'

junk text update 8923 mark complete update 8324 mark
complete more junk update 5438 mark complete update 5843 mark complete
+ update 1522 mark
complete more junk update junk and 5843 and 1522 mark
complete update 8435 mark complete update 9323 mark complete true junk
[download]

BTW, I like the single-quotes for delimiting the split regex.

Most don't. They consider it a bad habit of mine.

I'd rather leave everything alone if there's anything "non-digit" besides the and splitters in there.

s[update (\d+(?: and \d+)+) mark complete]{...}ge;
[download]