Hey Adam,
To enable nofollow for WordPress menu items, you can follow this guide: https://www.wpbeginner.com/wp-tutorials/how-to-add-nofollow-links-in-wordpress-navigation-menus/
For the social icons, you will need to override the x_social_global function which can be found in social.php located at \framework\functions. To do that, you will need to setup a child theme first. The instruction to setup a child theme can be found at https://theme.co/apex/forum/t/setup-how-to-setup-child-themes/57
Next, under this PHP comment in  your child theme’s functions.php.
// Additional Functions
// =============================================================================
Insert this code which is a modified x_social_global function. I’ve added rel="nofollow" to the social links.
function x_social_global() {
  $facebook    = x_get_option( 'x_social_facebook' );
  $twitter     = x_get_option( 'x_social_twitter' );
  $google_plus = x_get_option( 'x_social_googleplus' );
  $linkedin    = x_get_option( 'x_social_linkedin' );
  $xing        = x_get_option( 'x_social_xing' );
  $foursquare  = x_get_option( 'x_social_foursquare' );
  $youtube     = x_get_option( 'x_social_youtube' );
  $vimeo       = x_get_option( 'x_social_vimeo' );
  $instagram   = x_get_option( 'x_social_instagram' );
  $pinterest   = x_get_option( 'x_social_pinterest' );
  $dribbble    = x_get_option( 'x_social_dribbble' );
  $flickr      = x_get_option( 'x_social_flickr' );
  $github      = x_get_option( 'x_social_github' );
  $behance     = x_get_option( 'x_social_behance' );
  $tumblr      = x_get_option( 'x_social_tumblr' );
  $whatsapp    = x_get_option( 'x_social_whatsapp' );
  $soundcloud  = x_get_option( 'x_social_soundcloud' );
  $rss         = x_get_option( 'x_social_rss' );
  $output = '<div class="x-social-global">';
    if ( $facebook )    : $output .= '<a href="' . $facebook    . '" class="facebook" title="Facebook" target="_blank" rel="nofollow"><i class="x-icon-facebook-square" data-x-icon-b="" aria-hidden="true"></i></a>'; endif;
    if ( $twitter )     : $output .= '<a href="' . $twitter     . '" class="twitter" title="Twitter" target="_blank" rel="nofollow"><i class="x-icon-twitter-square" data-x-icon-b="" aria-hidden="true"></i></a>'; endif;
    if ( $google_plus ) : $output .= '<a href="' . $google_plus . '" class="google-plus" title="Google+" target="_blank" rel="nofollow"><i class="x-icon-google-plus-square" data-x-icon-b="" aria-hidden="true"></i></a>'; endif;
    if ( $linkedin )    : $output .= '<a href="' . $linkedin    . '" class="linkedin" title="LinkedIn" target="_blank" rel="nofollow"><i class="x-icon-linkedin-square" data-x-icon-b="" aria-hidden="true"></i></a>'; endif;
    if ( $xing )        : $output .= '<a href="' . $xing        . '" class="xing" title="XING" target="_blank" rel="nofollow"><i class="x-icon-xing-square" data-x-icon-b="" aria-hidden="true"></i></a>'; endif;
    if ( $foursquare )  : $output .= '<a href="' . $foursquare  . '" class="foursquare" title="Foursquare" target="_blank" rel="nofollow"><i class="x-icon-foursquare" data-x-icon-b="" aria-hidden="true"></i></a>'; endif;
    if ( $youtube )     : $output .= '<a href="' . $youtube     . '" class="youtube" title="YouTube" target="_blank" rel="nofollow"><i class="x-icon-youtube-square" data-x-icon-b="" aria-hidden="true"></i></a>'; endif;
    if ( $vimeo )       : $output .= '<a href="' . $vimeo       . '" class="vimeo" title="Vimeo" target="_blank" rel="nofollow"><i class="x-icon-vimeo-square" data-x-icon-b="" aria-hidden="true"></i></a>'; endif;
    if ( $instagram )   : $output .= '<a href="' . $instagram   . '" class="instagram" title="Instagram" target="_blank" rel="nofollow"><i class="x-icon-instagram" data-x-icon-b="" aria-hidden="true"></i></a>'; endif;
    if ( $pinterest )   : $output .= '<a href="' . $pinterest   . '" class="pinterest" title="Pinterest" target="_blank" rel="nofollow"><i class="x-icon-pinterest-square" data-x-icon-b="" aria-hidden="true"></i></a>'; endif;
    if ( $dribbble )    : $output .= '<a href="' . $dribbble    . '" class="dribbble" title="Dribbble" target="_blank" rel="nofollow"><i class="x-icon-dribbble" data-x-icon-b="" aria-hidden="true"></i></a>'; endif;
    if ( $flickr )      : $output .= '<a href="' . $flickr      . '" class="flickr" title="Flickr" target="_blank" rel="nofollow"><i class="x-icon-flickr" data-x-icon-b="" aria-hidden="true"></i></a>'; endif;
    if ( $github )      : $output .= '<a href="' . $github      . '" class="github" title="GitHub" target="_blank" rel="nofollow"><i class="x-icon-github-square" data-x-icon-b="" aria-hidden="true"></i></a>'; endif;
    if ( $behance )     : $output .= '<a href="' . $behance     . '" class="behance" title="Behance" target="_blank" rel="nofollow"><i class="x-icon-behance-square" data-x-icon-b="" aria-hidden="true"></i></a>'; endif;
    if ( $tumblr )      : $output .= '<a href="' . $tumblr      . '" class="tumblr" title="Tumblr" target="_blank" rel="nofollow"><i class="x-icon-tumblr-square" data-x-icon-b="" aria-hidden="true"></i></a>'; endif;
    if ( $whatsapp )    : $output .= '<a href="' . $whatsapp    . '" class="whatsapp" title="Whatsapp" target="_blank" rel="nofollow"><i class="x-icon-whatsapp" data-x-icon-b="" aria-hidden="true"></i></a>'; endif;
    if ( $soundcloud )  : $output .= '<a href="' . $soundcloud  . '" class="soundcloud" title="SoundCloud" target="_blank" rel="nofollow"><i class="x-icon-soundcloud" data-x-icon-b="" aria-hidden="true"></i></a>'; endif;
    if ( $rss )         : $output .= '<a href="' . $rss         . '" class="rss" title="RSS" target="_blank" rel="nofollow"><i class="x-icon-rss-square" data-x-icon-s="" aria-hidden="true"></i></a>'; endif;
  $output .= '</div>';
  echo $output;
}
Hope that helps.