This might be a solution. I would lower the number of flags to 10 or eleven.
But ... new bots can appear every second. They can be created / duplicated much quicker that discovered and neutralized.
A very unpopular solution comes to mind - captcha :(