Question is in the title, thanks in advance (:
Yes, you do. Even if you have sanitised the value when saving it, you should always escape on output.
<a href="<?php echo esc_url( get_theme_mod( 'url' ) ); ?>">
If you're outputting a
mailto: link to an email address, you also need to escape this with
esc_url(), just make sure that the
mailto: part is included in the escaped value, so that it's a valid URL:
<a href="<?php echo esc_url( 'mailto:' . get_theme_mod( 'mail' ) ); ?>">