Question about SAM CIGAR string
Q1: Yes, the CIGAR string operation 'M' means you can have both matches and mismatches. For example if you have a CIGAR string 10M, then you could have 10 bases that matched perfectly or you could have 5 matches and 5 mismatches. In this case, you have what are known as SNPs (or single nucleotide polymorphisms).

Q2: In your case, you have 99 matches, 170661 skipped regions in the reference genome, and 26 matches.

Q3: If you want to find out how many matches or mismatches there were, you'd have to take the reads from your SAM file, align them to their position in the reference genome, and compare them base pair by base pair to see if their nucleotides match. You can take advantage of the positional information found in field 4 of the alignment to accomplish this. 

You can write your own code to accomplish this or use  something like Samtools, which I believe comes with a variant caller.