Suppose I create sub domain per user, something like mysite.test.com which is secured under a wildcard ssl certificate. If I allow users to have their own custom url via a CNAME would the new url still be covered under the certificate or would I need a separate certificate per custom url?
No, I fear the previous answer is wrong. If you stick to giving users subdomains then your wildcard certificate will work, but if you allow users to map custom domains to their subdomains with CNAMEs, then they will need separate certificates for each custom domain, and separate public IP addresses as well.
Yes, CNAMEs work if the CNAME is within the wildcard's match pattern.
If your cert is for *.example.com, no you can't use a CNAME like joe.domain.com