Does the March update contain all fixes from prior updates as well?
Yes and No. No, the incremental update contains fixes not covered in last incremental update, which more or less comes down to patching newfound vulnerabilities most of the time. Yes, the latest or appropriate fastboot image would cover all the earlier fixes.
Do I have to install each incremental security update[?]
Yes and No. It comes down to how you want to update. If the boot and system partition has not tampered with and if you want to save bandwidth but intend to have the latest update, then go with incremental OTA updates. If your system or boot partition has been tampered or otherwise, then use the appropriate fastboot image available for your Nexus device here.
[Can] I just install the May one without installing April's?
Yes and No. Yes, you can switch to any newer update using the fastboot image I noted above. Flashing through fastboot requires an unlocked bootloader and unlocking a bootloader causes full wipe of user data.
No, you cannot switch to any random newer update using incremental OTA update. Reason: The incremental update requires one of the two build numbers to match, source and target. Source is the build number the currently installed Android system should be using and target is the build number of the installed Android system and same as the target build the update carries. Technically, it doesn't matter whether the build number of installed Android system matches with expected source since the update uses the build number of stock recovery as the build number of installed Android.
Note: stock recovery is automatically updated, if required, at every boot using install-recovery.sh located under /system/bin or /system/etc.
Consider this example: assume that you're on March security level with current build number MHC19I. You intend to side-load (since Android would not suggest you or provide an option anyway through System update) the May security level update with build MTC19T. During side-loading the update would check for source and target. It expects the source as the build number of the last update shipped from vendor which would be April security update with build number MHC19Q. Since that doesn't match, it would expect the build number of the target it is carrying which is MTC19T. Since neither of the build number matches, the installation would abort.
In case of confusion with target, understand that by expecting target I meant that the build number of the installed Android OS which would be same as the build number of the target the update is carrying.
I have noticed a lot of random reboots and the device running hotter than before, although I am not sure if this is because of the manual updates or a bad app.
It could be anything. However, given that installation of an OTA update is a dirty flash, remnants of previous version of files may be a cause. For many folks, clearing cache and/or data partition or doing factory reset fixes the issue, as LyricWulf noted.
Note: if you're using stock recovery, clearing data partition or doing factory reset would completely wipe any user data.
Reference: my own experiments with Nexus 6; the document OTA Package Tools.
