You have to clean up the pom.xml's. That is the only way. Remove ALL unused dependencies. Declare ALL used dependencies correctly: compile, runtime, provided, test. Delcare ALL used dependencies EVEN IF they're brought in transitively. This last point is so essential because the maven version algorithm relies on it.
In big companies, people have a terrible habit of just copy/pasting dependencies from one project to the next. Your pom _absolutely_ must be minimal and only import things you need, otherwise this happens.
One our checks fails the build if undeclared used dependencies are found, but also fails the build if unused dependencies are found. Developers that break these rules too often give an unfortunate meeting because it is this serious.
If these buildings blocks aren't correct, all of your efforts will fail. I used to work for a large Asian software company, that began with an A and ended in Ba. I helped rescue multiple giant codebases with this technique.
In my experience often developers try to take a shortcut where they try to bang out the large upgrade in one giant PR. Sometimes this works but it's very risky - more often I see very long running branches that get abandoned. It's much better to make guaranteed incremental progress, plus your PRs are much easier for your team to review.
My startup Infield solves this problem for python / ruby / JS backends through software for the project planning (we run a solver over your dependency graph and read every changelog to identify breaking changes) and people for the breaking changes (our team will open PRs where we fix breaking changes so your code is compatible). We're starting to think about moving into the statically typed backend world with java / .net / maybe scala. I'd love to hear more about exactly what you've run into and whether my experience here matches with these ecosystems.