Anyone have a query/policy for checking that the OS updates are recent on every node? TIA!

This isn't exactly what you want, but I was checking which devices have seen that latest macOS Monterey update with this:

SELECT p.key, p.value FROM plist AS p WHERE p.path like '/Users/%/Library/Preferences/com.apple.preferences.softwareupdate.plist' and p.key = 'ProductKeysLastSeenByUser' and p.value = 'MSU_UPDATE_21D62_patch_12.2.1';

Thanks for the tip. I should be able to get something going by reading these plists.