Just an FYI. I was able to fix the issue.

document.getElementById("trackingID").value = acctNum.replace(/[^\A-Za-z0-9?*\-\s]/g, "");

The reg exp was using the - as a range instead of a literal. I \-\s at the end and it is keeping the spaces as well as the dash.