I've implemented kind of a page hit counter as REST request. The article page renders a JS into the page that does a jQuery.getJSON to the REST resource later.
So far that works fine. The page is delivered from cache (X-Drupal-Cache:"HIT") and the browser does an extra request to the REST resource (/api/v1/check/l/1?_format=json).
Unfortunately the REST handler is not called for guest user views. Instead, Drupal delivers the cached response. It only works for authenticated users.
For guest I get
Cache-Control:"must-revalidate, no-cache, private" X-Drupal-Dynamic-Cache:"UNCACHEABLE"
And the REST handler is not executed. My REST response is
return (new ResourceResponse($rc))->addCacheableDependency(null);