Do I need to escape number in this shortcode function?

Yes, never trust user’s input.

Just because you told people to provide a valid number for a specific shortcode parameter, it doesn’t guarantee that the input will always be a valid number, so always secure user’s input — and output.

You should also, if you haven’t already done so, read these articles:

• Data Validation

• Securing Input

• Securing Output

And for example in your case, for accepting absolute integers only:

<?php
$cols = absint( $atts['num'] );
// Validate and set default value.
$cols = $cols ? $cols : 3;