I have locally sold ads on my site, and to comply with Google policies I use rel="nofollow" on the links.

But I also have onclick="window.open('clicks.php?redir=blahblahblah)", where clicks.php is a PHP script on my site that adds the click count to a database, then redirects the user using header("Location: $blah").

So the code looks like this:

<div class="ad" 
 onClick="window.open('https://www.example.com/includes/clicks.php?num=8285');">
  <a href="https://www.example.com/includes/clicks.php?num=8285" target="_blank" rel="nofollow">
   Blah Blah Blah
  </a>
</div>

A few days ago, I got a report from Google Search Console that clicks.php has a Redirect Error. So I'm guessing that, for whatever reason, they're still following the link, either through the <a href...> or the window.open(). Which could mean that I'm violating a policy, albeit inadvertently.

What do you guys suggest as the best method to ensure that they not follow these links?