Is the only difference between DDOS or spammer requests and those from people who value privacy and anonymity that the latter are able to solve a CAPTCHA? Or c

Is the only difference between DDOS or spammer requests and those from people who value privacy and anonymity that the latter are able to solve a CAPTCHA? Or could could Cloudflare et al do a much better job?