Serve the suspected bots a page with Javascript that computes a proof of work, submits it, and gets the real page in return.

Steamspy.com seems to trigger one of these basically every time when loaded with a fresh cookie.