Most of the time, CPUs execute processes’ instructions without involving the kernel; the kernel only has to step in if a user-level process causes a trap, either by attemptung to execute an invalid instruction (invalid here covering a variety of reasons) or by invoking a software interrupt. AES instructions are executed directly and the kernel doesn’t know that they’re being executed.
I don’t think there are any related performance counters you could use either. The AES instructions have an unusual execution pattern which may be identifiable statistically, but I’ve never tried that... And that’s not applicable generally anyway.
You could try using an appropriately-instrumented emulator such as Bochs, or analyse binaries to determine the instructions they use — Debian: what instructions do x86-64 binaries use? has more information on the latter.