CUG is used to restrict the access of the page and hence it will not available for the anonymous session. If you want it in your service, then only for the particular service where you are queries the pages for the tab, use the 'Service User' and give access to the service user. This would solve it.