If you decode a JWT from your first tenant, does it have an aud claim set to anything?
Also, under your tenant settings > General > API Authorization Settings, there is a “Default Audience” setting. You may want to check if you have something there for your first tenant and not for your second.