Short answer: Every bank and every tax provider out there uses SSL on its website to encrypt data between your computer and the website. You really don't need anything more.

VPN will serve to mask the actual websites you're visiting, but that isn't a concern here.

Pay for VPN if it'll make you feel better - but realize that your VPN provider will have the ability to see what websites you're visiting, instead of the hotel. You'll succeed only in shifting the power to someone else.