Although I really need to commit the final version as that one isn't quite what I use.
Cloudflare uses CAPTCHA to drive away proxy users. Privacy conflicts with Cloudflare's endgame of profiling every Internet user and then monetizing that data.
An attack-resistant trust metric? Although I haven’t seen them used against denial of service attacks.
Generally you don't. Just be prepared to scale resources and handle everyone.