The problem lies with the API permission to the StateProvince entity. Civi event users do not have access to this entity via the API. (I'm not sure why this is)

To fix this I created a custom drupal module with the civi hook: mymodule_civicrm_alterAPIPermissions

mymodule_civicrm_alterAPIPermissions($entity, $action, &$params, &$permissions) {

$permissions['state_province'] = array(
    'get' => array(
      'access CiviCRM',
      'access CiviEvent',
      'edit all events',
    ),
    'create' => array(
      'access CiviCRM',
      'access CiviEvent',
      'edit all events', 
    )
  );
}

Which gives CiviEvent users access to this entity via the API.

The problem lies with the API permission to the StateProvince entity. Civi event users do not have access to this entity via the API. (I'm not sure why this is)

To fix this I created a custom drupal module with the civi hook: mymodule_civicrm_alterAPIPermissions

mymodule_civicrm_alterAPIPermissions($entity, $action, &$params, &$permissions) {

$permissions['state_province'] = array(
    'get' => array(
      'access CiviCRM',
      'access CiviEvent',
      'edit all events',
    ),
  );
}

Which gives CiviEvent users access to this entity via the API.