What I use is Shavlik's HFNetChkPro, you can download a free 50 computer version from
http://www.shavlik.com/(It's the commercial version of Microsoft's HFNetChk & MSBA products)
It will scan a system and then allow you to easily download all the appropiate patches for that system to a folder on your system.
So just build a default W2K SP3 system with no patches and then have HFNetChkPro get the right patches and integrate these into your CD.