My guess is the service account running your Internet-facing application ($Guest) pool doesn't have access to something that web part uses. There's a lot of talk among developers on how to best raise web part permissions without compromising site security.
The other thing I've noticed, if you extend a web app and change some IIS settings, not all of the authentication changes trickle down. Check your security settings for folders under that virtual directory to make sure they match up with your auth scheme.