The CAPTCHAs are probably over-applied by people who use the defaults, but they're absolutely necessary for some sites, especially e-commerce. The alternative would be flat-out blocking requests that trigger the CAPTCHAs. An absolute shitload of traffic on the Internet is the abusive sort, and lots of that's aimed at sites that accept CC payments. Used correctly, CAPTCHAs mean you don't have to blackhole as much traffic, so actually increase the fraction of people who can reach your site, versus some other world without them where you'd just be forced (by costs & risks of dealing with abuse) to drop those requests.