A Website with no authentication has an mailchimp signup form embed. Vulnerability tools are reporting CSRF issues on the hosted website. Who can become victim in this case and how to prevent it and eliminate the security alert? Is this something mailchimp need to provide a fix for?
One of the pre-requisites for a successful CSRF attack is that the user should be authenticated already. From your question, it doesn't seem like the user is authenticated on that page.
In CSRF you forge an authenticated users request to submit some form data to make state change in the application.
There is a special case of CSRF on login pages, which is Login CSRF. In this, you make the user login with your own credentials to track the users activities. Suppose you are trying to attack an e-commerce application, you can make the user to login using your own dummy username and password. When the user later on pays for something online, they may unknowingly add their credit card to your/attacker's account. This case may be applicable to you.
In any case, the fix should be at 'mailchimps' end as they are the ones validating login info. Hence, embedding and validating the CSRF token should be performed by them.
It would be helpful to answer more accurately if you can provide details on the features that your application provides.