For the F/B issue we only get error 400 "bad content", even when errortracing on other forest we didn't get anything more to go on.Haven't tried the TLS regkeys yet but I was making a status and thought of something.
error 400 "bad content" doesn't really say anything but
https://docs.microsoft.com/en-us/exchange/troubleshoot/client-connectivity/exchange-security-update-issues#http-400-errors-in-owa-and-ecp-and-connection-failure-error-in-powershell + "Cannot serialize context" in event viewer 4001 events + this part of the tracelog
userName="domain\servername$"
tokenUserName="domain\servername$"
authenticationType="Negotiate"
activityId="{80003616-0007-EF00-B63F-84710C7967BB}"
failureReason="STATUS_CODE"
statusCode="400"
makes me think they might be related. Because there are people having issues authenticating with account names with $ in, and because it would fit the 'bad content' reply. Not sure how I can test this hypothesis though but thought I'd share