Bots that use a real person to solve aren't so much the problem as it doesn't ruin income from the ads within the CAPTCHAS, it's the high fail rate is what kills income. It must be simple enough to limit how many CAPTCHAS can be obtained and failed before it triggers a IP ban or something. I'm no coder but something like. If CAPTCHA failed or requested more than 3 times add ip to bad list. Or when 3k audio CAPTCHAS get requested and a GB of data of every few hours lol.

Has anyone had any experience with Incapsula? It works ok but getting mod_remoteip to work properly is a pain. Otherwise some users share the same timer