CloudFlare's CAPTCHA can be trivially disabled by the site owners if they so choose. It's a trade-off though - many leave it enabled to prevent a layer 7 attack... there's not many other options to do that and there's absolutely none available to anyone but the biggest sites.