I would recommend friendlycaptcha[1] which you can also run locally (including the server).
> Friendly Captcha does not depend on tracking your users and exploiting personal data.
What "advanced risk signals" are these that do not involve tracking (or fingerprinting) users?
> The difficulty of the puzzle, and therefore the time and resources needed to solve it, is intelligently and automatically scaled based on sophisticated risk signals to protect against advanced bots. Friendly Captcha is completely invisible and require no manual user challenge at all.
So... magic?