Menu elements are publishable: an unpublished element is hidden from visitors and shown to a signed-in admin, so "I can see it and they cannot" is usually this. The element's target does not hide it: an element that points at an unpublished page, or at a page restricted to a group, is still shown, and the visitor who follows it gets a not-found or access-denied page. The other cause is the cache: the menu is rendered differently for signed-in visitors inside a page that is cached, so members get the anonymous copy. A template that changes the menu per visitor must call preventCaching() or render that part separately (member pages and the page cache).