Do I need my own SOPs if I use a CRO?

Usually yes. Even when a CRO runs operational activities, the sponsor keeps oversight responsibilities and needs SOPs governing how it selects, manages, and oversees vendors.