Bypass permissions in custom module
Looking at webform_submission_access, prior to getting the PDF url, try:

// Where $sid is the webform submission id
$_SESSION['webform_submission'][$sid] = TRUE;


If that works for the anonymous user, it may grant access to view that submission.