Can adding nonces make challenge response authentications weaker?
This is vulnerable to a length extension attack. Given a valid nonce/MAC, the nonce can be extended to forge a new valid nonce/MAC value. This is because $m_4$ is appended to the end inside the outer hash.

How this affects you will depend on how you validate your nonce. But in general, this is not a secure construction.

There's probably more things wrong with it, but this was the one that stood out the most to me.


  Now The Architect™ suggested "Let us put a few more nonces in there, more randomness does not hurt."


Don't fall for this. Saying doing X doesn't hurt is NOT a valid reason do it. You'll end up buying yourself nothing, and possibly decreasing security. And it's also not a standard algorithm, so it won't exist in any programming libraries.