ActiveSync cross-site proxy issue with exchange 2010 coexistence with 2016

hi everyone,

i am in a middle of migration from exchange hybrid 2010 SP3 to 2016 hybrid,

the HQ site has exchange 2010 SP3 Server with all roles + 2016 mailbox server

other four sites also have exchange 2010 all roles exchange servers,

so after changing the NAT to 2016 server the outlook clients work fine without any issues but activeSync only works on the HQ site, the other site we get 403,401 IIS errors and clients cannot connect with mobile

the HQ URLS are set to mail.contoso.com/service

the other sites are not facing the internet, hence they are using internal URL with FQDN/Service

any ideas?

thanks in advance