UTM Google and other parameter problems

I don't use UTM parameters or anything outside of CMSB. Someone is trying to setup an email campaign and in the email are buttons leading to some of my pages. Those buttons are passing parameters to the URL which is loading the wrong pages (in this case restaurant location online ordering). So, I'll put some real URLs here and possibly over explain since I don't understand all the magic of the URL parameters and the online ordering widget I use.

CMSB: v3.05 (Build 2093)

My setup uses URLs like this:

Hunt Valley Location:

https://www.nalleyfresh.com/order.php?location=2

  list($locationsRecords, $locationsMetaData) = getRecords(array(
    'tableName'   => 'locations',
    'where'       => whereRecordNumberInUrl(0),
    'loadUploads' => true,
    'allowSearch' => true,
    'limit'       => '1',
  ));
  $locationsRecord = @$locationsRecords[0];
  if (!$locationsRecord) { dieWith404("Record not found!"); }
  
  unset($_GET['num']);
  unset($_REQUEST['num']);
  
  
  list($stateRecords, $stateMetaData) = getRecords(array(
    'tableName'   => 'state',
    'orderBy'     => 'name ASC'
  ));

So my location record is accessed through the URL. Simple CMSB.  Then basically, the online ordering company has a widget on the order.php page. I fill in some of the widget parameters with an ID and other info from the location record. In this URL case, it fills in info to load ordering for the Hunt Valley location.

Their widget adds some info to the URL which if you go there, you will see the final URL with CMSB location paramter plus the online ordering parameter which results in:

https://www.nalleyfresh.com/order.php?location=2#/restaurants/nalleyfreshhuntvalley/1063

(thats actually not the exact setup but I'm trying not to confuse and I assume the details are irrelevant and doesn't change a solution)  

All good. Completely integrated online ordering and I can add new locations easily. The Online ordering company gives me, what i believe they refer to as new "slugs" (snippets?) for a new locations.

So now, someone is coming along and trying lo link to these pages from an email campaign that is using UTM and other parameters. From their email:

This program includes emails that are sent to the customers. Within the emails, we have buttons that direct users to the Hunt Valley menu. https://www.nalleyfresh.com/order.php?location=2#/restaurants/nalleyfreshhuntvalley/1063

However, while we were testing the emails, we noticed that the URL ends up directing us to a different page. 

• Bryan was directed to the Owning Mills location and the URL changed to this:  https://www.nalleyfresh.com/order.php?location=2&utm_medium=email&utm_source=sharpspring&sslid=MzM3NjQxMzWzMDcwBwA&sseid=MzIwszAzMTA3NwQA&jobid=75ea5113-e600-43aa-8a68-349d0be02a9f#/restaurants/nalleyfreshhuntvalley/1063/ 
• I was directed to the Kenilworth location and the URL changed to this: https://www.nalleyfresh.com/order.php?location=2&utm_medium=email&utm_source=sharpspring&sslid=MzOxNDG2sLQ0MDa2BAA&sseid=MzIwszAzMTA3NwQA&jobid=28183d88-3837-4891-b926-3757684fa4d3#/restaurants/nalleyfreshhuntvalley/1063

Everything in the URL works fine up to the sharpspring parameter (https://www.nalleyfresh.com/order.php?location=2&utm_medium=email&utm_source=sharpspring), but anything after messes with which location to load and ends up loading the wrong location. Do you have any insight into why this is happening? 

Kenilworth is location 3:

https://www.nalleyfresh.com/order.php?location=3

Owings Mills is location 9:

https://www.nalleyfresh.com/order.php?owingsmills-9

Apparently in their URL, after the &, something triggers these other locations. By the way, as I'm sure you know, I noticed i could put https://www.nalleyfresh.com/order.php?whatever-9 and still load owings mills, so I assume whereRecordNumberInUrl 's magic grabs any number in the URL and loads the location. As you can tell by the way I'm writing, I sort of get what's happening, maybe, but don't know enough to fix this parameter issue. I searched UTM here and apparently, if it was only UTM parameters, you resolved that long ago in V2 something. So what's the issue with this URL and how do I get around it so they can track or whatever they are doing? I saw some other post that had some code and said something about parsing. If that's the answer, that's out of my league to figure out.

Please advise and thank you!