By far the most effective way to prevent bots is to charge for an account or service. Facebook, for example, banned billions of bots. At just 1 dollar an account, such a situation would be completely untenable. Not to mention most views are worth fractions of a cent - paying for bots wouldn't be a return on investment, so nobody would do it.

Bots are an inherent problem with free, advertisement-fueled web. If you want to get rid of them, it's trivial, but requires an re-understanding of how we use the web.

I'd never heard of them before getting them while using Brave search sometimes, I'm not sure I entirely understand how they work and differentiate between a bot and human.

I don't think there is any PoW that results in acceptable performance for the user (especially on mobile) while also making the cost for an attacker high enough to deter them.

Even renting the compute on AWS, it only costs $0.01 per minute for the equivalent of a decent desktop computer (c8g.4xlarge). While an attacker will likely either use a botnet, or hardware better suited for solving the PoW than the hardware the user is using.

Though CAPTCHAs don't really work well anymore either, since solving services are quite cheap. Recaptcha is nowadays primarily based on other factors, like IP reputation, susceptibility to google tracking, and behavioral scoring.

Most people engage with web content on relatively low powered machines. If you tune them to be tolerable on a 4 year old mid-range android device, there isn't much cost incurred on a threadripper.