The only thing there that I can see is the machines on CMA 3.6 / VSE 8. You really need to get these to at least MA4 / VSE 8.5 before you upgrade.
I'm not sure what agent version you have - did you mean 188.8.131.521? If so, in an ideal world, I would recommend upgrading your agents to Patch 3 (184.108.40.2064) or preferably MA 4.5, which will give you added benefit (such as SSL comms) when you upgrade the server to 4.5: but this is not compulsory.
Otherwise your approach seems fine
Thanks for your reply. If I download Agent 4 Patch 3 and check it into EPO it wont deploy automatically through Global Updating will it?
I will have to select the machines and select Deploy agent correct? Or use a task correct? I just dont want to check it in and start deploying it worldwide.
That's correct - the agent is installed by a deployment task, not an update task, so as long as your deployment tasks are *not* set to install the agent, you should be fine.