Rewrite need not "escape" the / with \ (also does not affect anything to have) in this specific case, your middle bar does not even need the ? (indicating the previous group or character as optional).
The problem that is returning .php is precisely because of the ? after the bar /, as you "said" pro rewrite which is optional in the first rule it directs to /produto.php?referencia=123123, but here comes the value problem /produto.php also "house" (match) with the regex ^produto\/?([-\w.]+)\/?$, see a test in regex101:
So what happens are two internal redirects:
- First that directs
produto/28.01157A_2 for produto.php?referencia=28.01157A_2
- Second that redirects
produto.php?referencia=28.01157A_2 for produto.php?referencia=.php
Removing the ? already resolves:
RewriteRule ^produto/([-\w.]+)/?$ produto.php?referencia=$1
And preferably, as you’re manipulating the querystring, add the flag QSA and to avoid conflict with other later rules add the flag L
RewriteRule ^produto/([-\w.]+)/?$ produto.php?referencia=$1 [QSA,L]