Nonce doesn’t validate in nopriv call

Use check_ajax_referer:
https://codex.wordpress.org/Function_Reference/check_ajax_referer

//Check nonce
if ( !check_ajax_referer( 'nonce-action-name', '_wpnonce', false ) ){
    echo __('Ajax Security Check', 'yourtextdomain');
    die();
}