I would speculate this may be related to the ability of the computer to impersonate the application pool identity over the network. The "Connect As" has the credentials saved (and encrypted), so it can create a full primary token and access resources as that user identity. With "Application User (pass through authentication)", that would be an existing token and attempting to use that token for impersonation. In that scenario, if the computer that is performing the impersonation is not trusted for delegation, it would not succeed.
This should be easy enough to test and validate.
Is the computer trusted for delegation? In Active Directory Users and Computers > Computer > Properties > Delegation tab. Select "Trust this computer for delegation to any service (Kerberos only)".
You may also need to set the IIS7 configuration setting "useAppPoolCredentials". This can be set with the following command:
appcmd.exe set config -section:system.webServer/security/authentication/windowsAuthentication -useAppPoolCredentials:true
useAppPoolCredentials = True with Kerberos Delegation on 2008