> The onus for proving that a visitor is not a bot should be on the server side,

Unfortunately that's exactly what is happening with ReCaptcha checking for Google cookies.