CUs will contain patches that are new and important for installation. Some could be contained in CUs, but they are also added to Windows Update and in the Security Bulletins.  I am not sure where in MS that you would find just that information.  That is why I use sqlserverbuilds.

You do not have to patch both in the same day, but think of this scenario and you can decide how you want to handle it.  If you patch the secondary and wait to patch the primary, then if the AG fails over to the secondary it will upgrade the databases to the new version of SQL and if the database version was updated, and the AG tries to fail back you will have a problem.  So you should plan on upgrading both to the same Patch version as soon as possible to avoid interruption.