If I'm not mistaken, the current CAPTCHA system can check users' browsing activity and if they find something a bit unusual or suspicious, usually the CAPTCHA system will verify whether the user is really a human or a robot. Therefore only some users get CAPTCHA verification and some don't. Even though this slightly intrudes on the privacy of users, there is nothing the platform can do to prevent their sites from DDOS or other suspicious activity.