The 22.214.171.124 address is the newer version of SecureDNS that as far as I’m aware is still in beta.
The 126.96.36.199 address is for the older version of SecureDNS.
CIS will install this way so if there is a problem with the newer service, the older service will act as a backup.
If you look at the SecureDNS webpage, it will tell you to use both addresses for the new SecureDNS. Why this is different than which servers are used if you have CIS change the addresses, I have no idea.
I would use 188.8.131.52 and 184.108.40.206 just for the redundancy in case the newer service has an issue.