The answers are all here:
Tell Google about localized versions of your page
Two of the most important key points to note are:
Each language version must list itself as well as all other language versions.
If two pages don't both point to each other, the tags will be ignored. This is so that someone on another site can't arbitrarily
create a ...
don't tell me you really index such parametrized urls? If yes - this has an outstanding negative impact.
If they are noindex-ed (what would be correct), then don't care about their canonicals and hreflangs. Your parameter-less urls are for Google - there should canonicals and hreflangs be correct.