It chooses the challenge weight based on signals. If your phone looks like a phone from a residential IP you get a simple challenge.
If you then spam requests you might get another, harder, hallenge appear.
If you have a data center IP and look like bot traffic you get a hard challenge out the gate.
AFAIU after looking at their docs several months ago.
