Nice little snippet. A few things to note:

It doesn't actually work. You have a comma inside the expression which is causing the match to fail because mIRC sees it as an argument separator. You should save the expression to a %var and then use $regex(%a, %var). Escaping dots and commas inside a character class also isn't necessary. e.g. [.\,] == [.,]

Inside $util.sanitizeNum() this is kind of difficult to read:

if (%a !isnum 48-57 && %a !isnum $iif($2 == dec,44-46,48)) {

For starters, you've used the ascii values instead of the literal characters. The conditional is also a bit confusing, because you've essentially got something like if (%a !isnum 48... && ... !isnum 48). Not to mention looping through 255 times is going to be really slow if it's used frequently (such as inside another loop).

I'm also not really sure it accomplishes the goal of sanitizing a number. If the 'dec' argument is given, it simply leaves all commas and dots regardless of the number system used. mIRC won't properly parse and calc a numbering system using dots as separators (e.g. 4.000.000) nor will it be able to do $calc(4,000,000). Commas are seen as argument separators, and even if it's inside a variable it won't be calculated properly. I'm not sure if the sanitizeNum alias was meant to work with dot separator numbering systems or not, but either way the commas should always be stripped for mIRC.

You can do the same thing with a simple $regsubex() replace:

alias util.sanitizeNum {
  var %expression $iif($2 == dec, /[^\d.]/g, /[^\d]/g)
  return $regsubex($1, %expression, $null)
}

which removes everything that's not a digit, or if 'dec' is specified everything that's not a digit or a dot.

$money.variations() uses the same slightly changed command three times, so it could be shortened. It also uses $regex() to check the format before anything is done, so there's really no reason to use $util.sanitizeNum() at all because you already know your numbers are in a specific format. This means you could simply $remove() the commas.

Line 6 also removes "m" when it should be removing "million", although using $util.sanitizeNum() makes all of the $remove() and all of line 6 redundant because it would strip all of the characters anyway.

alias money.variation return $regsubex($remove($1, $chr(44)), /^\$?([\d.]+)(?:(k)|([mb])(?:illion)?|(t)(?:rillion)?)?$/Si, $ $+ $bytes($calc(\1 * 10 ^ (3 * $pos(kmbt, \2))), b))