/form.html
This URL is clean — no gclid anywhere. The POST body sends no gclid either (unless you tick the server-wins box). If the lead still ends up with the gclid, it came from the server session.
tracking.gclid=CLIENTgclid999
—