"cvs update" uses the "?" character to tell you that it doesn't know anything about these particular files that it finds in the local copy of your repository. They're not officially part of the repository, nor have they been scheduled for addition. Here's a list of all the other single-character informational messages that CVS uses:

U [path]

Used when a new file is created in your local repository, or an untouched (by you) file has been updated.

A [path]

This file is scheduled for addition and will be officially added to the repository when you do a "cvs commit".