Have just enabled security review module and it's alerting to base url not being uncommented and set. This is a multi-site so do I need to set the base url in each settings file for each site? I set the base url in settings for the root site but the alert still came up for subdomain of multisite where have not changed its settings file.
To be more secure you should set the base url for each site, yes.
Setting this helps protect against a phishing attack where a malicious user manipulates Drupal's use of the host request header to make the site provide incorrect links.