old ?cid= and ?pid= URLs keep showing up in search results

If those parameters map to real pages on the new setup, 301 each one to its clean equivalent. Redirect rules can match on the query string, so you don't have to do it by hand. If they map to nothing, return a 410 or 404. The trap: don't block them in robots.txt. That stops Google crawling them, which means it never sees the redirect or the 404, and they can sit in the index even longer. The removals tool in Search Console hides them for about six months, which helps if they're embarrassing, but it's a band-aid. They drop out properly once Google recrawls and sees the redirect.