Duplicate leads and cookies

Do duplicate lead records have the same cookie association or different?

Duplicate leads are only duplicates to you. Until they're merged, they operate fully independently, with different associated web session(s) and different activity logs.

If we merge these two records, I assume the cookie from the one that had the most recent activity will override the other?

Any lead can have, in practice, an unlimited number of cookies, one for each device/browser/profile they use. I've leads with 100 associated cookies. You shouldn't think in terms of a singular "cookie."

When leads are merged, their activity logs and associations are also merged.