It’s basically what modern ddos protection does - the WASM computational calculation is a digital dew can.
It could be a complex math problem, or another common trick is to purposely trigger bugs like a javascript engine not rounding numbers correctly in edge cases.