I am aware that on Windows this is very much possible. But is it possible on Android [...] Can you install a virus/malware/spyware by just clicking on an image?
Yes, it is possible, although difficult. There is no fundamental difference between Windows and Android in terms of image decoder vulnerabilities. In fact, chances are that both systems are using the same library for decoding, with identical vulnerabilities. The precise mitigations (DEP, ASLR, stack canaries, etc) applied by the operating systems are similar as well.
The only way this can be done is if there is a severe security bug in the image library. A security bug may be able to hijack the library and trigger arbitrary code execution. In these cases, the malicious image is not actually an executable itself, but rather contains a slightly modified format that is not so different that it causes an error, yet is similar enough that it is processed by the library, triggering unintended behavior. These kinds of bugs are pretty rare, and they are fixed rapidly when they are discovered. You should keep your software up to date (preferably with automatic/unattended updates) in order to avoid having a vulnerable image library for long.
Also what exactly happens when someone renames a malicious apk to .jpg or .png or .mp4. Will the malware/spyware execute if you open the image/video?
If someone renames a malicious executable file so it has an image extension or otherwise find a way to pass it to the media decoder (e.g. changing the MIME type), you will simply get a message that the image cannot be displayed. The decoder will not automatically recognize the file and execute it if it is not an image. Decoders work by first checking for so-called magic bytes at the beginning of the file which specify the type of file. The bytes for an APK and for a JPEG file, for example, are completely different. If it does not see the JPEG bytes it will simply refuse to even try to parse the file.