There are a reasonable number of assumptions I'm going to have to make to try and answer this question. For perfect security, we require that the keystream is truely random, and never reused (OTP,shannon).
I've decided to add in a short answer here: STOP! There's absolutely no need to use a reduced character set thing anyway - you can just use your random number generator to generate a random byte and then treat your plaintext as a series of bytes rather than as characters.
Now, I take it you're intending to obey the no-reuse requirement, which leaves us with the question of what happens when my data isn't quite random enough?
Firstly, lets try and work out what a pool of 1000 characters would mean. To run an xor-cipher, we somehow translate the string of characters into a string of bits, using one of many character encodings. There are $2^8=256$ bits in a byte, so I deduce that by character you mean that each character is encoded into two-bytes (which is roughly how UTF-16 seems to work if you don't require very strange characters), meaning there are a total of $2^{16}=65536$ possible characters.
Now, how are you picking $1000$, or indeed $5000$ from them? If they're not randomly sampled from the total options, then you risk letting through some very significant information. For example, if your set is based around "common" characters then because of the way the character sets are constructed there are certain bits which are more likely to be set / not set in your collection of characters.
If you have managed to sample them totally randomly, then at the very least you're loosing out against a naive attack since there are only $1/5$ of the values to check.