Guest Entries plugin will only submit when logged in - not anonymously (via AJAX)
So can now answer this myself. Basically the issue is the CSRF token validation. 

Options are to disable CSRF in the config.php file. Up to you how comfortable you are with that. 

Or use the CSRF token properly! I thought I could set the token statically but that's not the case (which is obvious in hindsight). It is unique to each browser and is set as a cookie.  To work with a pure JS set up this needs be set dynamically as a JS variable on page load. More information here: https://craftcms.com/support/csrf-protection#updating-your-javascript