Yes you are right, the timezone is inherited from it’s parent, in this case the VirtualFeed.php. the getstartofday() function is called from line 81 after it has tried to get the timezone in line 78
I suspect you are right in that there may not be a $session due to not being logged in, but the userid can be determined from the dashboard or the feeds etc, even if the dash was public (rather than using an apikey) the users (account user) timezone could be determined.
I have many account for various clients that are almost identical so my emoncms server displays the full account name (not the user name) on the nav bar even when navigating public dashboards without an apikey OR logged in user session.
This fits in nicely with another discussion I’ve had recently where a some of us think the timezone of any dashboard or visualization should be determined from the account (ie the geographical location and therefore the timezone) of the property being monitored (certainly in the case of home energy monitoring at least).
I think this might be occurring for you because you have Virtual Feeds with Daily totals that need an account TZ to work, other visualisations just use the browser TZ, (see Timezone in EmonCMS) .
Perhaps @nchaveiro or @TrystanLea can offer some wise words?