What they are supposed to do is help prevent a website that accepts and presents user-supplied content from being overwhelmed with automated spam.
I started reading Engineering Security, by Peter Gutmann. Excellent book, btw. At the start of the book he discusses security theory vs. reality. One thing he describes is the "most ineffective CAPTCHA of all time" (according to mainstream security theory). This "ineffective" CAPTCHA on a blog required exactly one thing: the user had to enter the word "orange."
Surprisingly, the blog received zero spam. The reason it's so effective is because it's different. Whereas CAPTCHA is a monoculture. Standard CAPTCHA fits into the economic model for spammers. But for spammers to adjust their behavior for just this one blog? It's not worth it for them.
It has a direct benefit to users who are readers (since it reduces the spam they are subject to) and users who are contributors of things they want read (since it reduces the spam that their contributions would otherwise be buried in).