I didn't have issues per se with bots, but people trying to hide their location (think Nigerian user using a US-based VPN).

My trick was to get the device's timezone (which you don't need privacy permissions for on web or mobile). If it didn't match up with the ip address's country (or was in a banned country), then the account was banned.