As a best practice , never allow nested web.config for single website. Avoid using multiple web.config as applicationhost.config try to make traversal search to locate web.config. As a best practice there should be one web.config.
Changes in Applicationhost.config
Remove unnecessary module such windows authentication , if web site is open to all web users.