You could give your users a score and the higher it gets, the more features become available. VPN on/off, registered since x days, ... a bit like normal Email reputation. Also speaking about automation, a legit user probably won't mind if all features aren't available right away or additional 2FA steps are needed. That kind of approach is also in part used in perimeter-less/zero trust security.

Also I'm thinking if Selenium is used, checking timing of the requests might be helpful. (In theory it should be possible to triangulate the users with multiple API servers by the way.)