First, about umask... When a process creates a file, it uses the open() or creat() system calls. Both calls have a mode parameter to set the mode of the file. The mode is the number you're mentioning as 600 or 644. The kernel does not use the mode directly as it creates the file. Instead the file's mode is set to the expression "mode & ~umask". A process can change its umask value via the umask() system call. But it inherits its original umask from the parent.

This leads to my suspect: a faulty parent. The parent process, when overloaded or something, is spawning children incorrectly.

I'm not a web expert nor a perl expert. But I think that the parent of of cgi scripts is the webserver itself. The error in the parent should be researched. Maybe a new release or something is available?

If I'm right, a quick fix would be to modify the cgi scripts to set their umask to 0. This is probably as simple as inserting "umask(0)" or something like that as the first line. Maybe Optimus_P can chime in here with the perl syntax for that.