Detecting chrome headless that spoof navigator properties - bots

Question

I buy web traffic from several sources (including the major names in the industry) and recently got reports from advertisers that there's quite a bit of "invalid" traffic. They won't share which filter they use so I can block it on my end. I tested all the navigator properties, resolution, window size, modernizr features, etc, and the bad traffic seems to be spoofing everything.
After some testing, I found that using this code:
document.addEventListener('click', function() {
window.open('/save?' + navigator.userAgent ,'_blank');
});
In some cases, the saved user agent is different from the one saved on the top window. Meaning, a visit hits a page, in that page the user agent could be something like:
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML,
like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/18.17763
Then that page uses window.open() to open a new window and reads the user agent again, and it will read something like this:
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko)
HeadlessChrome/72.0.3617.0 Safari/537.36
I tried all the usual methods, window.chrome, webdriver, permissions, plugins, fonts, reading those vars in an iframe, etc, they pass all the tests, the only thing that works is the window.open, but I obviously can't open a popup to filter the traffic.
Is there any way to detect this type of traffic?