I think AWStats has a a list of "bot" useragents regexs. I'd probably start there.

That said, I know my sites get many thousands of hits from rogue comment spam and email harvesting bots with forged user agents.