If the poster of the webhooks does not authenticate to Jenkins, then non-public projects will not be triggered. The root cause is that the call in GerritWebhook.java  [getJenkinsInstance().getItems()] only returns a list of items that are visible to the caller. Since this call runs in context of the (non)authenticated user account that posts the webhook, the private projects are not visible, and as such nothing will be triggered.