Here A39-41 correspond to the provisions of IRPA, see
https://laws-lois.justice.gc.ca/eng/acts/i-2.5/page-9.html#docCont
A39 - 41 refers to the inadmissibility based on financial reasons, misrepresentation or non-compliance with IRPA.
All applications have to go through A39-A41, but it will depend on the officer based on the circumstances of the application where a specific check is required or not.
Security is done by CBSA / CSIS and other partner agencies. They submit a report to IRCC, based on which IRCC will make a final determination. No note is added to the GCMS notes, except that page 2 of security says passed in GCMS notes obtained from CBSA.
To read more on security see
https://bit.ly/3apWglN