Currently, I’m hashing (SHA2) a few extracted bytes I collect from a CSRNG to create keys for AES encryption/decryption. Is that wrong?
Depends on what you mean by "a few"; if you mean 16 or more, then yes, that is likely to be secure. However, if you mean, say, 4, then that is Very Bad.
The reason is that the hash function doesn't do magic; if you use only 4 bytes of CSRNG output, and then compute:
$$Key := SHA256( \text{CSRNG Output} )$$
then what an attacker can do is exhaustive search over all 4 bytes of possible CSRNG output, compute the corresponding keys, and test them; there are only $2^{32}$ possibilities; a single laptop is likely to be able to go through all of them in perhaps an hour.
But I could also skip SHA2 and extract more random bytes from the CSRNG until I’ve got enough bytes for a key. Is that a better idea?
Well, you'll likely need that many bytes of CSRNG output to form a secure AES key anyways; once you have that many, the SHA256 doesn't add anything.
Or is SHA2 not one of those hashes that might make things less random?
No, SHA2 is not likely to be a weak hash function. However, the problem is that SHA2 doesn't make things more random -- if there are only $2^{32}$ possible inputs to SHA2, there are only $2^{32}$ possible outputs. It might make things look more random, but that's not what we care about.
