On the primary only. Even though we are getting to the SQL Server instance via the AG listener, we're still monitoring at the overall instance. The AG listener will follow the primary replica, so we'll follow just like other apps.
That was what I was afraid of. So if we still have jobs running on the secondary server, we still need to monitor all servers in the cluster, not just the listener. Thank you for your quick response!