If IOC is enabled then it is what is used. IOC takes precedence over Organization Relationship.
I would think that IOC was created in the past and not by the Hybrid Wizard .
When the issue is TLS, quite often there is an EV Application Event with ID 4020 with detail “unexpected error on a send”. If you see it most probably the issue is TLS.
As you have coexistence, probably the Load Balancer pool is sending the cloud FB requests to IIS FÉ to one of the Ex16 servers. From there the request should go to the IIS BE for the server that holds the database that holds the on premise user that availability is being fetched for.
Mirela_Buru suggested RCA. It may output an error and detail for the BE IIS server that replied. It is a good idea to do the RCA and then follow that request in logs. IIS FE, BE, EWS HTTP proxy. If they don’t reach the BE on the server that holds the user it would probably mean authentication issues with r issues from 2016 to 2010.
Not sure if can use log collector on Win 2008 to get the necessary logs and then use Notepad++ to do a folder search against the log collector result searching for the username, requestID or simply by searching busy.. if not possible to use log collector you can get them manually to a folder. Check the status codes for cross premise requests and if there is any specific error.
https://microsoft.github.io/CSS-Exchange/Diagnostics/ExchangeLogCollector/
Healthchecker script checks for TLS, however It does not check for Exchange 2010/win2008
https://microsoft.github.io/CSS-Exchange/Diagnostics/HealthChecker/
F12 on OWA for cloud account does not help much, to check the reply error, if all else fails , the way to go would be to enable Outlook logging however you would need an active case with MS support to review the ETL. For TLS you can use fiddler to see if TLS is used or wireshark to actually see the TLS negotiating and handshake.
if you can find an error code this table may help:
https://techcommunity.microsoft.com/legacyfs/online/media/2019/01/FB_Errors.FixesV6.pdf