Last time I looked into this I found out this shit is actually called "Cloudflare Turnstile", and it basically fingerprints your browser (and probably IP matters too):

For Turnstile, the actual act of checking a box isn’t important, it’s the background data we’re analyzing while the box is checked that matters. We find and stop bots by running a series of in-browser tests, checking browser characteristics, native browser APIs, and asking the browser to pass lightweight tests (ex: proof-of-work tests, proof-of-space tests) to prove that it’s an actual browser.

https://saidit.net/s/technology/comments/blx4/cloudflare_turnstile/ (source links there)