Here is how the system works:
Initially the CAPTCHA will appear at random say ever hour, correctly answering the CAPTCHA however will start to massively ramp up the time between subsequent CAPTCHA's.
Answering the CAPTCHA incorrectly initially, but getting it right in the same session after a few attempts will have no effect on CAPTCHA time.
Continuing to issue mouse and keyboard commands whilst the CAPTCHA is active but not answering, or immediately disconnecting when the CAPTCHA appears will massively ramp down the time between CAPTCHAS.
That's the initial idea for the system, obviously needs some tweaks and refinement but in a nutshell that system will stop botting stone dead and be very little hindrance to genuine players.
The CAPTCHA only need appear at all if the client/servers detect activity that may be botting. And a legitimate player detected in this way, that has answered the CAPTCHA a few times, will have the time between CAPTCHA's massively increased.
So once running it will be something like, excluding the botters:
90% of players will never see a CAPTCHA
10% of players, who trigger the bot match pattern, will very quickly have it reduced down to say once every 2 days or even more.