As outlined in the README, there is more than one way to include CPM.cmake in your project. Instead of including the full get_cpm.cmake script as found in the releases, you can shrink it down to the essentials to easily include it in your main CMakeLists.txt.

[...]
# download CPM.cmake
file(
  DOWNLOAD
  https://github.com/cpm-cmake/CPM.cmake/releases/download/v0.40.8/CPM.cmake
  ${CMAKE_CURRENT_BINARY_DIR}/cmake/CPM.cmake
  EXPECTED_HASH SHA256=78ba32abdf798bc616bab7c73aac32a17bbd7b06ad9e26a6add69de8f3ae4791
)
include(${CMAKE_CURRENT_BINARY_DIR}/cmake/CPM.cmake)
# add dependencies here
CPMAddPackage(...)
[...]

Note however, that using this short version requires an active internet connection on first configure, even when the CPM_SOURCE_CACHE is set and populated. To update the version of CPM.cmake that is included, update the version number in the url and SHA hash as found in the most recent release asset.