AKS has three items to update.

1. AKS version.  
2. Node OS Security patches.
3. Node image version upgrades. This includes the security patches from item 2.

AKS version

This should be upgraded only to versions Redgate Clone supports.

It's recommended to manually upgrade because AKS will choose versions that have not been tested with Redgate Clone.

Node OS Security patches

Security patches are updated daily, but are not applied until the nodes are rebooted.  AKS does not reboot the nodes. You must do it manually. 

We do not recommend manually rebooting the nodes.

Turn off this feature.  The node image version upgrades below include the security patches.

Node images version upgrades

Please turn this on by choosing "Node Image" for the managed security channel when creating the cluster.

This updates to the latest VM image, including security updates.  New versions are usually available weekly.

If you choose the "Unmanaged" option, security updates are never done.

Microsoft learn documentation

AKS upgrade practises