Probably a form of proof of work which is costly for the bots but fair on normal users (combined with normal fingerprinting and IP check which determines how hard the challenge should be for a request)