The "?" has a special meaning in request URLs and it's used to separate the request path and the request parameters. Why do you need the "?" to be part of the request path if you aren't sending any request parameters in the URL?
My app is protected by policy rule /myApp/*?*, if the ? is deleted from request(see 1st. comment) the rule will not be match and access will not be allowed. I am just curious, if it is expected behavior on WildFly(or is it configurable), because I've not observed it on different containers.