Removing utm_ parameters will probably always work, because they are standardized and shared between different applications (like the website and Google Analytics). If you try to obfuscate them your analytics software can't read them as well.

But yeah, home grown analytics can't be reliable circumvented.