I applied CU3 to SQL Server 2017 yesterday afternoon. I don't have a lot of load running against this server currently (3 QA people and some developers - 25 databases) but so far I'm not seeing the dreaded 30% I/O hit that some articles have mentioned. Using Redgate SQL Monitor, I compared a 3 hour window this morning against the same window a week ago and see nothing out of the ordinary. I looked at CPU usage on the VM and on SQL Server as well as average disk read/write on the data, log and tempdb drives. Everything looks like very similar to before the patch. I will continue monitoring this during the day today and will be patching our DEV box this afternoon. DEV has 10 developers hitting it and some report writers / analysts as well so it sees more I/O. This will give me a better idea if a busier box will show more of a hit.

A little about the QA box:
Windows Server 2016 (not patched for Meltdown / Spectre yet - one step at a time) (VM)
64GB RAM
4 core
Largest DB ~ 500GB - active QA work going on against this database.

(more to come)