Demystifying Hybrid Free/Busy: what are the moving parts?

I see that you already have TargetSharingEpr and that is pointing to Hybrid Agent. Normally you don't need to change TargetAutodiscoverEpr (even if wrong) cause you are not using it due to TargetSharingEpr being populated  but you can re-run HCW because TargetApplicationUri is wrong and this will restore default settings.  Again, I am assuming that Autodiscover for your contosomail.com, contosoorg.org are pointing to on-premises Exchange in public DNS and not Office 365. If Autodiscover (still) points to Office 365, then HCW would set it like this (wrong) and you would need to switch back to on-premises. Then HCW would set it right.  In conclusion, TargetApplicationUri must be the on-premises one and this has to be set somehow (manually or thru HCW)

Also, I am assuming that these DomainNames contosomail.com, contosoorg.org are the primary SMTP domains used in Scheduling Assistant, for example, CloudUser@contoso.com will put these attendees in the Scheduling Assistant OnPremUser1@contosomail.com and OnPremUser2@contosoorg.org.

If these 2 conditions are met, then f/b request would go on that org relationship. And if you still have an error related to the security of the message, recycle EWS app pool or IISreset onprem on each exchange server.