Although "who knows" is almost as an expression for giving sense however, expressions can be statements, orders, and questions, so does the expression: "who knows" need a question mark?
"Who knows?" is an example of a rhetorical question, because it is really a statement that does not actually ask for an answer.
The consensus is that it's sometimes OK to skip question marks for rhetorical question. Some people will say you shouldn't ever skip a question mark for a rhetorical question, and no one minds if you use a question mark, so I suggest that you do. (Personally, rhetorical questions without question marks always throw me off -- John Grisham has a habit of doing this and it causes me to read these sentences in a weird, sarcastic tone)
Here is more information from Wikipedia:
Depending on the context, a rhetorical question may be punctuated by a question mark (?), full stop (.), or exclamation mark (!), but some sources argue that it is best to use a question mark for any question, rhetorical or not.
Yes, you have to put a question mark for "Who knows?" simply because MacMillan Dictionary has done so in a similar example.
See for yourself: who knows/cares/wants/needs etc SPOKEN used for saying that you do not know/care etc, and you think that no one else does 'Won't Terry be upset?' 'Who cares? He never thinks about anyone but himself.'