Proof of work captchas are pretty hard to tune. You need it high enough to deter spammers (who can pre-compute and dont care about latency), but low enough not to deter real users on low powered devices who are using your site live and get more frustrated every second they have to wait.

It might work for spammers who really are just making billion of attempts, but then again if they are making that many attempts then you can block on the IP level.

This is basically how Apple does things. Instead of proof of work, they bake the tokens into devices.

The basic idea is that they'll happily let you sneak a few spam messages through iMessage if you're willing to spend a few hundred dollars on a burner iPhone. This is one reason why they're so resistant to allowing gateway protocols between iMessage and third party devices or RCS.

That is what those Cloudflare "checking your connection before proceeding" page is doing.

Spammers would actually prefer it I think. I think for each captcha solved, spammer are ready to pay more than real users(be it electricity or real money). They were already paying real humans before AI became good enough for solving captcha.