As I didn't create it, I'd like to know how do I find out what the cert is actually used for?
If you go to the Details page, the Delete button will be grayed out if it is in use somewhere. Hovering over the button will tell you where it is used. Or, use the "Del" link from the list view of certificates. If it is used, you'll get a list of places it is used.
And, can I just delete it?
If it's in use, no. You'll have to remove its usage before. If the system allows you to delete it, it was not in use.
Or do I have to renew it?
Only if you still use the function that it is intended for. For example, if you configured SSO, you need a new certificate to allow SSO to continue working. If you don't need that feature, you can just turn it off, then remove the certificate.
Note that you won't get any more warnings after expiry, and expired certs don't count against the org limits, so there's really no "harm" in allowing it to stick around.