You could use a two-stage approach: in the first stage you extract the entire part from <\/Mil to \x9D. In the second stage, you remove any control characters from the extracted substring:

sub remove_ctrls {
    my $s = shift;
    $s =~ tr/\x90\x8F//d;
    return $s;
}

$text =~ s/(<\/Mil.*?>.*?\x9D)/remove_ctrls($1)/esg;
[download]

The /e option makes the substitution part be treated as Perl code, i.e. it calls remove_ctrls() with the extracted substring.

Personally, I find this easier to read than overcomplex regexes which would do it all in one go... YMMV, of course.