I haven't ever set one up myself, but from studying them for a while I think it actually turns out to be a combination of all three. On these two new servers, 'dpkg -l | grep perl' produces 149 lines, so clearly a lot of modules are installed as .debs (and I think mark even used to recommend doing everything that way, via dh-make-perl and puppet). Now, the OpenID modules are not among them, so I think we can assume they were installed from CPAN by hand. Ordinarily, that would be perfectly fine, since one of them indicates a dependency on JSON, and CPAN appears to have installed the latest version of JSON too.

But then we have to consider the "other process in place" -- the installation of Dreamwidth itself, which contains quite a number of perl modules, either by copying a complete installation from another webserver or by extracting it from various version control repositories. Sadly, a copy of JSON 1.00 is included in this code tree and, thanks to "use lib", takes precedence over the newer one installed by CPAN.