Error message on exchange server with hybrid setup to Office365

Question

Hybrid setup between Exchange 2016 and Office 365, 50% of the of the users are migrated to Office 365 and currently no problems reported. A few months later (today) I discovered this error message in event viewer that shows up about once every hour, not at a specific time.

I have tried google and been asking around, but we havn‘t been able to find the problem or the cause.

1. The Id of S-1-5-21-xxxxxxxxxx-xxxxxxxxxx- xxxxxxxxxx -1186, is it a user or the Exchange itself?
2. Any idea of what could cause this error? I do see the word „Photo“ multiple times in the stacktrace below...

Process 20624: ProxyWebRequest FederatedCrossForest from S-1-5-21-xxxxxxxxxx-xxxxxxxxxx- xxxxxxxxxx -1186 to https://outlook.office365.com/EWS/Exchange.asmx failed. Caller SIDs: OAuth. The exception returned is Microsoft.Exchange.InfoWorker.Common.Availability.ProxyWebRequestProcessingException: Proxy web request failed. ---> System.Net.WebException: The request failed with HTTP status 401: Unauthorized. at System.Web.Services.Protocols.SoapHttpClientProtocol.ReadResponse(SoapClientMessage message, WebResponse response, Stream responseStream, Boolean asyncCall) at System.Web.Services.Protocols.SoapHttpClientProtocol.EndInvoke(IAsyncResult asyncResult) at Microsoft.Exchange.InfoWorker.Common.Availability.Proxy.Service.EndGetUserPhoto(IAsyncResult asyncResult) at Microsoft.Exchange.InfoWorker.Common.UserPhotos.UserPhotoApplication.EndProxyWebRequest(ProxyWebRequest proxyWebRequest, QueryList queryList, IService service, IAsyncResult asyncResult) at Microsoft.Exchange.InfoWorker.Common.Availability.ProxyWebRequest.EndInvoke(IAsyncResult asyncResult) at Microsoft.Exchange.InfoWorker.Common.Availability.AsyncWebRequest.EndInvokeWithErrorHandling() --- End of inner exception stack trace --- . Name of the server where exception originated: XXXXXXXXX. XXX: 43532. Make sure that the Active Directory site/forest that contain the user's mailbox has at least one local Exchange 2010 server running the Availability service. Turn up logging for the Availability service and test basic network connectivity.