Hi Pete.
For our customers, we recommend testing the main functions that are most common for use (workflows, check-in/out, revise, etc), but generally speaking I've found that the key thing to focus on is anything that has been created with tools outside of the normal Windchill functionality (i.e. custom code implementation), especially if external classes are used within your codebase. If you are using the wtSafeArea concept to push your customizations out after PSI installations complete, this is very easy to do. Regarding custom code itself, if it is relatively small/light and uses classes that have been persisted in Windchill core functionality for some time, you're pretty safe. If you are using custom code to build full-on brand new objects, JSP pages, etc then I would dedicate more testing to these items.
Overall, CPS updates are generally much less "intrusive" as far as the update procedure goes than point or version releases.
We do not typically install every CPS for our customers - we let the customers themselves determine when they want CPS updates, and they typically do not update until a CPS comes out that addresses a significant issue they have, IF they are having one. I am about to update one of our customers from 10.2 M030 CPS07 to 10.2 M030 CPS14, for example.
If you'd like, feel free to let me know more about your system - you can e-mail me directly if you like, and I'll be happy to answer any questions you may have.
