I got this to work - here is the OUTPUT:
5.05.2016 16:10:28.478 *INFO* [0:0:0:0:0:0:0:1 [1462479028291] GET /content/SlingQuery.html HTTP/1.1] com.community.aem.impl.QueryImp **** CUG Child pages are: /content/geometrixx/en/toolbar/contacts/Test1
05.05.2016 16:10:28.478 *INFO* [0:0:0:0:0:0:0:1 [1462479028291] GET /content/SlingQuery.html HTTP/1.1] com.community.aem.impl.QueryImp **** CUG Child pages are: /content/geometrixx/en/toolbar/contacts/Test2
05.05.2016 16:10:28.478 *INFO* [0:0:0:0:0:0:0:1 [1462479028291] GET /content/SlingQuery.html HTTP/1.1] com.community.aem.impl.QueryImp **** CUG Child pages are: /content/geometrixx/en/toolbar/contacts/Test3
05.05.2016 16:10:28.478 *INFO* [0:0:0:0:0:0:0:1 [1462479028291] GET /content/SlingQuery.html HTTP/1.1] com.community.aem.impl.QueryImp **** CUG Child pages are: /content/geometrixx/en/toolbar/contacts/Test4
05.05.2016 16:10:28.478 *INFO* [0:0:0:0:0:0:0:1 [1462479028291] GET /content/SlingQuery.html HTTP/1.1] com.community.aem.impl.QueryImp **** CUG Child pages are: /content/geometrixx/en/toolbar/contacts/Test5
Here is the pages that belong to a CUG:

They belong to a CUG named membersonly. See:

Notice that a System user (not an AEM USER) named datacug belongs to this group.
Now we map the System user to the OSGI bunlde using Sling Mapping:

Now you can use the System user you configured in Sling Mapping to access the CUG Pages in the Java code-- see:
package com.community.aem.impl;
import org.w3c.dom.Document;
import org.w3c.dom.Element;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import java.io.StringWriter;
import java.util.Iterator;
import java.util.List;
import java.util.ArrayList;
import java.util.HashMap;
import java.util.Map;
import javax.jcr.Repository;
import javax.jcr.SimpleCredentials;
import javax.jcr.Node;
import javax.xml.parsers.DocumentBuilder;
import javax.xml.parsers.DocumentBuilderFactory;
import org.apache.jackrabbit.commons.JcrUtils;
import javax.xml.transform.Transformer;
import javax.xml.transform.TransformerFactory;
import javax.xml.transform.dom.DOMSource;
import javax.xml.transform.stream.StreamResult;
import org.apache.felix.scr.annotations.Component;
import org.apache.felix.scr.annotations.Service;
import javax.jcr.RepositoryException;
import org.apache.felix.scr.annotations.Reference;
import org.apache.jackrabbit.commons.JcrUtils;
import javax.jcr.Session;
import javax.jcr.Node;
import com.community.aem.*;
//Sling Imports
import org.apache.sling.api.resource.ResourceResolverFactory ;
import org.apache.sling.api.resource.ResourceResolver;
import org.apache.sling.api.resource.Resource;
import com.day.cq.wcm.api.Page;
import com.day.cq.wcm.api.PageFilter;
//This is a component so it can provide or consume services
@Component
@Service
public class QueryImp implements Query {
//Inject a Sling ResourceResolverFactory
//Inject a Sling ResourceResolverFactory
@Reference
private ResourceResolverFactory resolverFactory;
/** Default log. */
protected final Logger log = LoggerFactory.getLogger(this.getClass());
@Override
public String getJCRData(String location) {
Map<String, Object> param = new HashMap<String, Object>();
param.put(ResourceResolverFactory.SUBSERVICE, "datacug");
try {
//Get the title of the AEM web page at this specific location - assume its a value such as /content/geometrixx/en/services
ResourceResolver resourceResolver = resolverFactory.getServiceResourceResolver(param);
Resource res = resourceResolver.getResource(location);
//Adapts the resource to another type - in this example to a com.day.cq.wcm.api.page
Page page = res.adaptTo(Page.class);
String title = page.getTitle(); // Get the title of the web page
//Write out the CUG Pages - the user datacug belongs to the UCG that has access to these pages
Iterator<Page> it = page.listChildren() ;
while (it.hasNext()) {
String name = (String) it.next().getPath();
log.info("**** CUG Child pages are: "+name);
}
return title ;
}
catch (Exception e)
{
e.printStackTrace() ;
}
return null;
}
}
There is a lot here - we will get this into a HELPX article - how to use SLING APIS to query pages that belong to a CUG.
Also - as mentioned by Joerg and Lokesh - you cannot do this without using a System user who belongs to the group.