Hello, Olga.

If you want to simply remove it (or at least tell Google bots that it's removed), use "410 Gone" status, not 404. For user experience, I'd redirected those subdomains to index page of domain, or, if you have time and resources, create a landing page, saying something like "Sorry for inconvenience, the content is not there anymore, use search to find whatever you need ", add a search bar of main domain content, viola!

Hope this helps.

5mil+ links?! Wow!

What's their spam score? I'm surprised they are not blocked or something

To answer your question - what does common sense tells you? The job of google and google bots is pretty much based on common sense. So, duplicate content website, ridiculous amount of links, no referral traffic - all these are obvious signals to run, Forrest, run!

1. We use click metric to track calls from mobile devices for all our clients. It's decent metric (not good, not bad), simply because if I clicked on phone number, it doesn't necessarily mean that i gonna call it - it might have been a mistake, or i just changed my mind. So, It's a metric to get overall idea how many people are at least interested. From experience, those numbers (clicks to actual calls correlation) are pretty close - about 90%. The only other options there is (as far as I know), is call tracking, but that's what you are doing already and trying to stop doing

2. I don't see any reason why it would be bad from Search Engines point of view. The only negative part i see is extra action from user (which you already mentioned) and that crawlers wouldn't be able to see those phone numbers if you do showing through javascript.