As a someone who works behind a corporate proxy, where dozens are sharing a single external ip, I can tell that the puzzle is really 20% of what actually goes on.

1. Mouse tracking
2. Identifiable browsing tracking data extraction
3. Automatic rejection for unusual high traffic

As a rule of thumb, any thing that requires Google CAPTCHA, I do it out of the corporate network.