You have a really nice Perlish solution. It's unnecessary to replace most of the string with itself though, if you can stand using an experimental assertion. The substitution would then look like this:

s/(?(?{rand() >= 0.1})(?!))./?/g
[download]

Here's a benchmark comparing the two versions.

use strict;
use Benchmark qw(cmpthese timethese);

my $str = '?' x 100_000;

cmpthese(timethese(-10, {
    assertion => sub {
        $str =~ s/(?(?{rand() >= 0.1})(?!))./?/g;
    },
    eval => sub {
        $str =~ s/(.)/rand() < 0.1 ? '?' : $1/eg;
    },
}));

__END__
Benchmark: running assertion, eval for at least 10 CPU seconds...
 assertion: 11 wallclock secs (10.09 usr +  0.01 sys = 10.10 CPU) @  8
+.51/s (n=86)
      eval: 11 wallclock secs (10.02 usr +  0.02 sys = 10.04 CPU) @  3
+.09/s (n=31)
            Rate      eval assertion
eval      3.09/s        --      -64%
assertion 8.51/s      176%        --
[download]

lodin