They don't detect if you're a bot or not; it just makes it more expensive, the idea being that doing $action 10,000 (or more) times becomes much more costly for the attacker, preferably to the point where doing $action (posting spam, creating accounts, etc.) is no longer profitable. It's probably more useful to see it as a ratelimiter than a bot detection mechanism.

They don't detect if you're a human exactly. What they do is they create a calculation expense that is negligible if there's one of you but adds up quickly if you're running a bot farm that needs to send out 10,000 requests a second.

So I click the button, my browser does a quick proof-of-work, no big deal.

But an automated script will have to complete that proof-of-work every time it encounters it, skyrocketing the cpu costs for the server.

They make it expensive to run large scale bots, so that deters the bots.

And they (probably?) use the computation power to crack passwords from people to let the government agencies access their accounts...