When using drupal_get_query_parameters(), should I still run values through filter_var() or check_plain()?
drupal_get_query_parameters() doesn't perform any sanitisation of vars at all.

If you need to validate the incoming value, or filter it for XSS before it is outputted, etc., you'll need to do that as normal.