Html is stored in the database and rendered dynamically but any images it references are served from disk by IIS.
CSS files are listed in the style.config file of the skin and those files are combined, minified and cached by our csshandler and also then cached by the web browser, but just like with html, any images referenced by css are served from disk by IIS.
I would make sure that in IIS you have the site configured for anonymous and widows auth and that the user that is the identity on the application pool has file system read permission on the entire web directory structure and full control over /Data and /App_Data as well as files and folders beneath those.
Hope that helps,
Joe