If my Sensors are managed by the Central Management Console (CMC), should I upgrade the CMC or the Sensors first?

Normally, you can upgrade either one first, but you should consult the Release Notes first, before performing any upgrade.

Support recommends upgrading all Security Analytics devices in the cluster in a timely manner. You should try to have all sensors and CMC upgraded to the same version sooner rather than later.  There may be core functionality missing until all devices are running the same version.