This part of the request (URL)
is an attempt to put PHP code in a URL; it's the equivalent of
<?php bloginfo('rss2_url'); >
It may be that some hacker code in a compromised page is built to take the query parameters of the page and try to execute that code for some purpose.
As long as you have: completely rebuilt the site (from scratch?), but also reinstalled all themes and plugins from reliable sources, and then looked at any other files in the site folders (even if they are 'outside' of the rebuilt site), and also changed all credentials (hosting, ftp, users, etc) ensuring strong passwords, and inspected all customized code for traces of hacker code, and rebuilt your sitemap, you can remove those pages from search results using the technique in the other answer.
But, be aware that there are other search engines besides the Google, so you will need to check them also. An updated sitemap will help with that, although it may take some time to get fully 'clean' search results on all search engines.