The CUs aren't regression tested, and do sometimes introduce issues. SPs include the CUs, plus potential internal fixes for things that were in a customer specific hot fix, or might fix another issue that was noticed. they are also regression tested with the full test suites.

Personally I like the CUs in terms of addressing issues that someone might have, but for keeping patched on the majority of servers, I'd stick with SPs. One a year seemed like too few, but I'd be happy if we could just get that one.