No CAL is required for anonymous user.
Check this article from Microsoft:
SharePoint Server: Licensing Resources and Documents
Internal users make content, information, and applications publicly available to users via the Internet (for example, on a public-facing company website). A mix of internal and external users anonymously access the site, including employees. No SharePoint CALs are required. External user access is permitted under the server license, and SharePoint CAL requirements for internal users are waived for access to content, information, and applications made publicly available via the Internet.
Server: One SharePoint Server license per running instance of the
software.
Internal users: CALs aren’t required
External users: CALs aren’t required