spent 3 months building a bot detection system and it still fails every day

i dont know what to do anymore. simple api for my website, takes form submissions from clients. but 70% of traffic is bots and i tried everything

first i did rate limiting by ip. bots just grab new proxies. then i added user agent checking. they fake it. then i made a custom captcha with questions about cats. they still get around it ,i looked at the request logs, they look perfect. right headers, right timing, they even store cookies. this is not just a script hammering one endpoint, these are smart agents mimicking human behavior

then i found a human verification system using eye scanning, but what caught my attention is they have open source components for proving uniqueness without storing data. maybe that could be used for an api somehow

but who is gonna scan their eye just to fill out a form on some random website. thats crazy. but the current situation is also crazy . i thought about just accepting the spam and filtering it out later with a script. but then im just playing catch up forever. the bots will adapt to my filters anyway

so yeah im stuck. what do you guys use for bot detection that doesnt require users to solve 50 puzzles