Clean GET parameters after submitting a 'GET' form
FormState::cleanValues does exactly that:


  Removes internal Form API elements and buttons from submitted form values.
  
  This function can be used when a module wants to store all submitted form values, for example, by serializing them into a single database column. In such cases, all internal Form API values and all form button elements should not be contained, and this function allows their removal before the module proceeds to storage. Next to button elements, the following internal values are removed by default.
  
  
  form_id
  form_token
  form_build_id
  op
  


But as you're not POSTing the form you can't really use it. Two options spring to mind:


Implement your own cleaning method. This might be tricky as you don't have the form fields to work with so unless you have a list of known good fields available, there's always the possibility you'll include something you don't mean to
Change your form's flow to Post/Redirect/Get (PRG). The steps are roughly:


Change the form method to POST
In the submit handler: 


Use FormState::cleanValues to clean the input
Build a new Url with the desired redirect path, and query options made up of the clean form state values
Use $form_state-&gt;setRedirect($url); to redirect the user to the new URL



From the user's point of view, nothing really changes. They still end up at the same URL, just without the undesired query args.