I'm not sure if you are still having the problem, but I was experiencing the same. I could perform the query using Graph Explorer but not when I tried in code. I could get all the way to the SP List but not the SP List Items. I am using the example provided on GitHub (here). After many iterations of trying different things out, I finally found the issue. It was in the ValuesController.cs file. Specifically, you need to add each permission to the "graphScopes". By adding "Sites.Read.All", I was able to return SP List Items.

     string[] graphScopes = { "Files.Read.All","Sites.Read.All" };                
            AuthenticationResult result = null;
            try
            {
                // The AcquireTokenOnBehalfOfAsync method will first look in the MSAL in memory cache for a
                // matching access token. Only if there isn't one, does it initiate the "on behalf of" flow
                // with the Azure AD V2 endpoint.
                result = await cca.AcquireTokenOnBehalfOfAsync(graphScopes, userAssertion, "https://login.microsoftonline.com/common/oauth2/v2.0");
            }
            catch (MsalServiceException e)
            {

}

I'm not sure if you are still having the problem, but I was experiencing the same. I could perform the query using Graph Explorer but not when I tried in code. I could get all the way to the SP List but not the SP List Items. I am using the example provided on GitHub (here).

After many iterations of trying different things out, I finally found the issue. It was in the ValuesController.cs file. Specifically, you need to add each permission to the "graphScopes". By adding "Sites.Read.All", I was able to return SP List Items.

     string[] graphScopes = { "Files.Read.All","Sites.Read.All" };                
            AuthenticationResult result = null;
            try
            {
                // The AcquireTokenOnBehalfOfAsync method will first look in the MSAL in memory cache for a
                // matching access token. Only if there isn't one, does it initiate the "on behalf of" flow
                // with the Azure AD V2 endpoint.
                result = await cca.AcquireTokenOnBehalfOfAsync(graphScopes, userAssertion, "https://login.microsoftonline.com/common/oauth2/v2.0");
            }
            catch (MsalServiceException e)
            {
            }