I think some amount of captchas are enabled by default, but you can certainly turn them off entirely for your domain if you prefer.
Note that users can also use Privacy Pass to avoid captchas while remaining anonymous.
(Disclosure: I am an engineer at Cloudflare, though I don't work specifically on anything related to captchas.)
