I've come to the conclusion that most bots are not that sophisticated. Basic CSRF-protection seems to eliminate most automated requests and the need for captchas.
That is true for crawling bots which hit simple web forms. Also using some JavaScript kills most of them.
Although such methods won't work with targeted bot attack.
I would say in my experience CSRF-protection has proven very effective at even preventing targeted password brute-force.
> Although such methods won't work with targeted bot attack