If it has both Immunity and Resistance, use Immunity only
You are meant to apply the multiplier for immunity only, in the case that the monster has both immunity and resistance. I suppose it's because immunity is stronger than resistance, and that's the one that goes.
Case Study: The Ice Devil
The Ice Devil has an overall CR 14, has immunity to 3 damage types, and resistance to 3 damage types. By dismantling this monster's design, we can learn how the designers did it and how we can follow that process.
Calculating its Offensive CR
The following is the creature's ability to deal the most damage:
Wall of Ice (70 damage): 35 cold damage, hitting at least 2 creatures;
Multiattack (64 damage): One Bite (12 piercing + 10 cold), One Claw (10 slashing + 10 cold), One Tail (12 bludgeoning + 10 cold);
Multiattack (64 damage): One Bite (12 piercing + 10 cold), One Claw (10 slashing + 10 cold), One Tail (12 bludgeoning + 10 cold).
The Ice Devil's DPR is \$\frac{70+64+64}{3} = 66\$, which puts it at CR 10. At this DPR, it should have a +7 to-hit bonus, but the Ice Devil has a +10. This means its final Offensive CR is CR 11.
Calculating its Defensive CR
So we know the final CR and the Offensive CR, and so we can get the Defensive CR. This is:
\begin{align}
\text{Round}(\frac{x + 11}{2}) = 14
\end{align}
\begin{align}
x = 16,17, \text{or } 18
\end{align}
Now let's start removing points off this CR.
Finding its Effective AC: 22
- It has 4 saving throw proficiencies, so its AC is increased by 2 for the sake of CR calculation. It also has the trait Magic Resistance which increases its AC by another 2 for the sake of CR calculation. Its listed AC is 18, so its EAC is 22.
Base Defense CR: 11
- The listed HP for the Iced Devil is 180. Without multipliers and an EAC of 22, this means its Defensive CR should be CR 11. But it's clearly not.
Defense CR, only Resistances: CR 13
- So let's multiply its HP by 1.25 to account for its resistance to three damage types, and the expected CR is between 11-16 (because its CR is 14). This gets its EHP to 225, with an EAC of 22. Its defensive CR should be CR 13. But again, it's not.
Defensive CR, both Resistance & Immunity: CR 19
- So finally, let's multiply its HP by 1.5 to account for its three immunities to damage types. This brings its EHP to 337.5, and with a EAC 22, its CR should be 19. But this is too much -- it only has a Defensive CR 17, and CR 18 at most. A Defensive CR 19 will put its final CR at CR 15.
Defensive CR, only Immunity: CR 16
- Let's step back, then, and apply only a 1.5 multiplier for immunities, discounting its resistances. Then its EHP is 270. Its EAC is 22, which brings its Defensive CR to CR 16. This is just enough!
Conclusion
Based on the Iced Devil, you only take into account the immunity multiplier, when the creature has both immunities and resistances.