Those are typical sources of those behavior:
Apple Mail / Apple Mail Privacy Protection (MPP) — Apple preloads images through a proxy so tracking pixels fire even if a human never opened the message. This inflates “opens” dramatically for Apple Mail users who opted into MPP. customer.io
-
Gmail Image Proxy / image caching — Gmail routes images through Google’s proxy servers; this can result in automated pixel fetches or image caching behavior that looks like an open. Warmup Inbox
-
Microsoft Defender / Safe Links (and other Microsoft scanning features) — Microsoft’s link protection scans and time-of-click checks can cause immediate automated “click” activity or follow-throughs on rewritten links. These are commonly seen for Office 365 recipients. Microsoft Learn+1
-
Secure Email Gateways / Email Security Products (Proofpoint, Mimecast, Barracuda, Cisco, Trend Micro, etc.) — These services often (a) open images to inspect content and (b) follow links in mail bodies (or rewrite and re-check them) to protect users. That generates opens and clicks from their scanners. Proofpoint+1
There are different strategies that can be used to distinguish a bot from a real browser. One is using a list of user agents, that will be normally slightly different from real users. That list would need to be created empirically.
The second option would be using certain signals. Bots would react within seconds of sending an email, reside in a Cloud IP address, with a limited IP pool, and open all links, which is different from a real user just open the links that are revelant for them. Using some AI it would be surely possible to spot those patterns.
The third option would be to include a Javascript that will be executed on the destination page of the link click. Probably it is difficult to control all the landing pages, but it could be technically feasible to inject a javascript when hitting the Mautic redirect link.Just some ideas to get you going.