The largest known bot net had ~30,000,000 computers at that scale CPU's work just fine. Not that it's the only thing to do with a bot-net of that size, but it's clearly a lower-bound where if your not doing a denial of service attack or sending spam you might as well mine bit-coins.

Assuming the average CPU runs around 2 Mhash/s that's 60,000,000 Mhash/s which is the equivalent of about 75,000 ModMiner Quad @800Mhash/s which would cost 75 million, so you would probably still top the mining charts.