A lot of their endpoints are rented or hosted from ASes that are well known, e.g. M247 Ltd. If I wanted to vastly reduce annoying VPN traffic, I'd simply block these ASes as well. That's likely the cause of these.

There isn't a lot Mullvad can do about it. Not all providers of hosting are willing to tolerate VPN endpoints in the same way they don't like hosting tor exit nodes.

hCaptcha seems to be increasing in popularity, have tasks that actually stump current bots, and not discriminate by IP address.

reCAPTCHA is the GoDaddy of CAPTCHA services. It doesn't achieve its purpose and the CAPTCHA task is often just a time waster. It's already decided whether you're a bot or not - which is not based on your mouse movements, but rather your IP address reputation and whether you're signed into Google. It only still exists because of brand inertia. I'd like to see a Google executive put before Congress and forced to complete a reCAPTCHA over Tor.