A WAF is like insurance, most of the time you wont need it, but its good to have when the s*it hits the fan.

While you can rely on your app to have its own security, it never hurts to have extra (unless latency is a concern).

I'd start with an open source version and move up to a commercial product if its necessary.