What is the Risk of Rotating Keys
$\newcommand{\AE}{\mathit{AE}}$
Let $\AE$ be an authenticated cipher (AES-GCM) and $E$ an unauthenticated cipher (AES-CBC).

Let $k_1$ and $k_2$ be independent uniform random.  Let $m$ be a message.  Let $c_1 = \AE_{k_1}(m)$ and $c_2 = E_{k_2}(c_1)$.  If the adversary knows $k_1$ and $c_2$, but not $k_2$ or $c_1$, can they learn anything about $m$?

The answer is no: the security of $\AE$ and the randomness in the initial choice of $k_1$ is irrelevant; if an adversary could learn anything about $m$ from the ciphertext $c_2$, that would violate the semantic security of $E_{k_1}$. 


   In particular, if we had an algorithm $A(k_1, c_2)$ which returned $m$ with probability $\varepsilon$, we could use this as a ciphertext distinguisher for the cipher $E$ with advantage at least $\varepsilon$: pick a key $k_1$ uniformly at random, and submit challenge messages $m_0 = \AE_{k_1}(m)$ and any other $m_1 \ne m_0$; then, given a challenge ciphertext $c = E_{k_2}(m_b)$ for unknown $b$, run $A(k_1, c)$ and guess $b = 0$ if $A$ returns $m$, and $b = 1$ if not.


What if you re-encrypt the same messages with fresh independent keys?  Same deal.

There are operational issues to worry about too:


Is eavesdropping of $k_1$ and $c_2$ (and $k_3$ and $c_4$, etc.) the only power of the adversary, or can they forge and modify things too?
If the adversary can influence $c_1$, motivating the use of the authenticated cipher AES-GCM, can they influence $c_2$?  Naive use of AES-CBC may expose you to padding oracle attacks.
Rotating keys doesn't prevent an adversary from using old keys to decrypt old ciphertexts.  It only prevents them from using old keys to decrypt new ciphertexts or vice versa.  If the adversary ever records old ciphertexts, then any future disclosure of the old keys will reveal the plaintexts.
The narrow cryptographic question here—of whether $m \mapsto (k_1, E_{k_2}(\AE_{k_1}(m)))$ has semantic security or ciphertext indistinguishability—isn't affected by the additional details about key rotation.  But what is the bigger picture here—what resources do you have, what are you trying to do with them, what attack surfaces does the adversary have to exploit these resources, and what are you trying to prevent the adversary from doing?  Do you have a living design document setting all of this down?  This is bigger picture is where you should focus your efforts to make sure your whole design is sound before worrying about little cryptographic details.