SQL Server Patching question
Updates for SQL Server consist of applying the most recent service pack, then the most recent cumulative update, then any updates you require that are newer than the most recent cumulative update.  i.e. do 1, then 2, then 3.

Service packs are cumulative in that they embody all the changes made in the prior service packs, allowing you to go from the RTM release directly to service pack 2, skipping service pack 1 since those changes are included in service pack 2.

Cumulative updates are, as the name indicates, also cumulative, although they only capture the changes since the most recent service pack released prior to the cumulative update package.

Check this post for details of which updates you should consider.  This site provides excellent details for various service packs, cumulative updates, and fixes for SQL Server.

Note that as-of SQL Server 2017, service packs have been discontinued in favor of simple cumulative updates.  This should help eliminate confusion regarding what to apply since you only need to apply the most recent cumulative update, then any fixes you need that have been released since that cumulative update.