I get a lot of CRUD/FLS security risks on the checkmarx scanner results while scanning our managed package. Does one need CRUD/FLS checks on public custom settings or can they be considered as false positives?
We can not set FLS on public custom settings. Considering that it appears false positive because if we can not set FLS then what is use of checking the FLS. With this background in mind you have 2 options:
Prepare false positive documentation
Convert this public custom settings in private and provide custom interface(using VF & apex) to manipulate this custom setting.