When you view a website, make sure in the top bar of the browser it says SECURE next to the website address. If so, then the connection between your device and the website is encrypted and should be protected from hackers, even on public WiFi. Most websites are SECURE (SSL encrypted or "https") now. This is especially important on any page on which you type a password, enter a credit card number, or view financial info. (On pages without any passwords etc., probably not a big deal whether a page is encrypted or not.)
If you open a website and things start acting "funny" - weird pages popping up, messages about pages you normally view not being secure? Then I would stop using that WiFi.
If you use your phone's mobile data and not WiFi, there is no need for a VPN at all.
I do use a VPN when I travel - one I set up at home, to connect my devices to my home network while I travel. I also do this so I can access computers at home while I travel. I assume this is not on of your needs, but it also gives me a little extra browsing security I probably don't need most of the time.