Unless you're able to explicitly state how this is done and/or how to trick it in think you're "high risk" - then seems like speculation; yes, I'm aware Google's said this, but never seen an proof of it. I've found bug in the past in the system that were easy to fix, told Google, but the bugs never were fixed.

Try doing a Google search from tor. The catches that tor users get are borderline impossible because of the suspicious ip and/or browser.

Not impossible, very often I get the "Body of water" one, but I do seem to get a challenge every 10 minutes or so, in each new tab.

I've experienced this first-hand. I used to always get the checkbox, but then one day I had to download a large series of related files from a website that used reCAPTCHA. I did all the clicking manually, but in a very repetitive and bot-like fashion, by opening a series of 10 new tabs at a time and then performing the same series of clicks on each tab to get to the download link. After a few minutes, I stopped getting checkboxes and started getting increasingly more difficult CAPTCHA challenges.

It's not speculation. It's section 2 of the paper, titled "Analyzing Risk Analysis System."

I can't find the original source, but the system for deciding whether to just show a check box or not was super complicated.Back around a year and a half ago when it was first released, some people on 4chan's technology board (/g/) were frustrated because they'd repeatedly be marked as suspicious (and never got the check box only) when posting on 4chan (which requires a captcha to be solved for each post). One user in particular was reverse engineering it and published a ton of super interesting stuff on Github (the levels of obfuscation were insane), but later got a job offer from Google (allegedly) in exchange for deleting it.