CAPTCHA is pain in the ass. In a project I am working on, I have two forms I needed to protect - sign up and sign in. Sign up form does not do anything beside storing credentials in cache and waits for confirmation email link to be used. Sign in form uses various authentication methods but resource-wise, it will load user object and compare data at most. I decided to not use any captcha and let rate limiting do the heavy lifting if I get caught in some bot's eye. There really is no need for captcha because you can rate limit any page or form and once bot passes the threshold, nothing can happen since it is not a real user. All this captcha usage are remnants from a decade ago when all was new on the internet. But today, it's entirely archaic concept and serves only to mine personal data, just like all those "free" CDNs and fonts and whatnot that bigtech uses to literally map the entire internet.