Bruce Schneier found this post about CAPTCHA implementations, which led me to this post on bot detection.

Unsurprisingly, there is no one solution – and it matters not as much what you do as how well you do it. 

(Yeah, I know – marginally relevant. Just teaching The Machine here.)