When you have your SharePoint application enabled with Anonymous access, often can occur the exception:

Microsoft.Sharepoint.Client.ApiBlockedException

This is, because some Rest methods can be disabled on web application scope. You can run this commands, to show
list, which methods are not approved:

$webapp = Get-SPWebApplication "Url of your app"
$webapp.ClientCallableSettings.AnonymousRestrictedTypes

FullName                    : Microsoft.SharePoint.SPList
MethodNames                 : {GetItems, GetChanges}
GetPropertyNames            : {}
SetPropertyNames            : {}
UpgradedPersistedProperties :
...

Line MethodNames indicates, that GetItems and GetChanges are forbidden on SPList object.

You can enable them by using this command:

$webapp.ClientCallableSettings.AnonymousRestrictedTypes.Remove([microsoft.sharepoint.splist], "GetItems")
$webapp.Update()

Now, your Rest query to GetItems should be working.