why can't customers see custom CMS content, unless they login to the site?

It seems to be happening to a lot of people. I think it has to do with the new permissions features and the CMS records, but I could be wrong. There is a thread from Thursday on here by @Steve Goldberg with a few band-aids in it until NS gets it fixed.

well we are having no issues, when customers login to the site, its just when they are logged out.

My theory is that it has something to do with this change. Just recently we had to change our CMS records to "Use Permissions List" and add the View permission to our Customer Center role, but if the user isn't logged in, then they don't have a role, thus no permissions. Likely we will need to change the CMS records back to "No Permissions Required for Internal Roles>Unauthenticated Users Access"

how come these CMS records are locked tho

They must be part of the SC bundle. I thought they were locked by our 3rd party.

so there is really no way to update the permission list

Maybe not.