Although "who knows" is almost as an expression for giving sense however, expressions can be statements, orders, and questions, so does the expression: "who knows" need a question mark?
"Who knows?" is an example of a rhetorical question, because it is really a statement that does not actually ask for an answer.
The consensus is that it's sometimes OK to skip question marks for rhetorical question. Some people will say you shouldn't ever skip a question mark for a rhetorical question, and no one minds if you use a question mark, so I suggest that you do. (Personally, rhetorical questions without question marks always throw me off -- John Grisham has a habit of doing this and it causes me to read these sentences in a weird, sarcastic tone)
Here is more information from Wikipedia:
Yes, you have to put a question mark for "Who knows?" simply because MacMillan Dictionary has done so in a similar example.
See for yourself: who knows/cares/wants/needs etc SPOKEN used for saying that you do not know/care etc, and you think that no one else does 'Won't Terry be upset?' 'Who cares? He never thinks about anyone but himself.'