The real secret of an effective captcha-like system is to identify/collect lots of data, identify suspicious patterns, validate them (checking what kind of data exposes a bot-like system) and then use this for serving dynamic challenges based on a couple of information.
Example: if the system identifies the user as a bot, it tries to give a less performant solution in terms of PoW.
Example: if the system identifies the user as a bot, it tries to give a less performant solution in terms of PoW.