Load posts via AJAX without draft status

admin-ajax.php is treated as part of the admin, so protected statuses will be included. To solve this just explicitly define post_status as publish to only get published posts:

$args = array( 'post_type' => 'project', 'post_status' => 'publish' );

Or, better yet, consider using the REST API for AJAX requests, instead of the aging admin-ajax.php approach. If you want to query a custom type and receive JSON then you probably don’t even need to create your own endpoint.