You should be able to gain a small speed boost by using a non-threaded version of Perl, plus, there's always the Advanced Perl DBI talk. DBI's prepare_cached might help for some cases of repeated statements, too.
Anyway, I do not see anything wrong with your test code as you have laid it out (and was certain that the likely culprit was CGI.pm). I trust that your production code is of similar quality, and hope that the apples-to-oranges comparison by your client was, well, apples and oranges. And not HTTP to HTTPS...